ObjectTypeMismatch

Why it happens

Entra ID will not soft match objects of different types. Microsoft's example is a mail-enabled security group in Microsoft 365 with smtp:tax@contoso.com and a new on-premises user given the same proxy address.

Where you see it, and what it affects

Entra Connect reports this as an export error on the Microsoft Entra connector, and it shows in the Microsoft Entra Connect Health for sync errors report. It happens during soft matching, when Entra Connect tries to link a new on-premises object to an existing cloud object by a shared value such as proxyAddresses, and the two objects are different types: user, group or contact. A typical case is a mail-enabled security group created in Microsoft 365 that uses the same address as a new on-premises user.

How to fix it

1. 1

   Step 1

   Identify the duplicated address and the two objects.

2. 2

   Step 2

   Keep the address on the correct object and remove it from the other.

3. 3

   Step 3

   Let sync run.

Check that it is fixed

• On the Entra Connect server, run Start-ADSyncSyncCycle -PolicyType Delta. In Synchronization Service Manager, open the Operations tab and select the latest Export to Microsoft Entra ID: the object should no longer be listed with an error.
• In the Microsoft Entra Connect Health sync errors report, the error should be gone after the next refresh. The report updates every 30 minutes, and Export downloads the remaining errors as a CSV file.

Sources

Full guide: How to move from on-premises Active Directory to Microsoft Entra ID →