InvalidSoftMatch

Why it happens

The hard match found nothing, and the soft match found a cloud object whose immutableId differs from the incoming source anchor. Usual causes are duplicate proxyAddresses or userPrincipalName values on two objects, a forest move, a deleted and recreated account, or a reinstall of Entra Connect with a different source anchor attribute.

Where you see it, and what it affects

Entra Connect reports this as an export error on the Microsoft Entra connector, and the Microsoft Entra Connect Health for sync errors report lists it with both objects side by side. A hard match links objects by the source anchor (immutableId). A soft match links them by proxyAddresses or userPrincipalName, and only works on cloud objects with no immutableId set. The on-premises object is not provisioned until the duplicate is fixed. Duplicate attribute resiliency lets new objects provision without this error, but does not remove the duplicate.

How to fix it

1. 1

   Step 1

   Use the Connect Health sync errors report or Synchronization Service Manager to find the duplicated value and both objects.

2. 2

   Step 2

   Decide which object should keep the value.

3. 3

   Step 3

   Remove the value from the other object in its source directory (on-premises AD for synced objects), or delete the wrong object.

4. 4

   Step 4

   Let the next sync cycle run, or start a delta sync.

Start-ADSyncSyncCycle -PolicyType Delta

Check that it is fixed

• On the Entra Connect server, run Start-ADSyncSyncCycle -PolicyType Delta. In Synchronization Service Manager, open the Operations tab and select the latest Export to Microsoft Entra ID: the object should no longer be listed with an error.
• In the Microsoft Entra Connect Health sync errors report, the error should be gone after the next refresh. The report updates every 30 minutes, and Export downloads the remaining errors as a CSV file.

Sources

Full guide: How to move from on-premises Active Directory to Microsoft Entra ID →