Mismatch between AD & Azure

Question

Mismatch between AD & Azure

Amir Administrator 0

Hi

I can see mobile nr. under Azure for any user but can not see in AD.

How can I delete this item in AD? There is any mismatch between Azure & AD.

Where can I find this item in AD.

3 answers

Your answer

Answer 1

Anonymous

Hello @Amir Administrator

Based on your description you see a mobile number for a user in Entra ID but not in your on-premises Active Directory (AD), it usually means the attribute is out of sync or has been edited directly in Azure AD. This creates a mismatch where Azure AD becomes the authoritative source for that attribute, and changes in on-prem AD will no longer sync to Azure AD for the mobile number.

Where to Find the Mobile Number in AD

In on-premises Active Directory, the mobile number is stored in the "mobile" attribute of the user object.

You can view or edit this attribute using:

Active Directory Users and Computers (ADUC): Open the user’s properties, go to the "Telephones" tab, and look for the "Mobile" field.
User's image

PowerShell: Use Get-AD User with the -Properties Mobile Phone parameter to view it

To delete the mobile number for a user in on-prem AD:

Open ADUC and Select the user Right click and select properties then go to general tab you can see the telephone option you can remove the number and click on apply it will save.

PowerShell: Use Set-AD User -Identity username -Clear mobile.

I hope this information is helpful. Please feel free to reach out if you have any further questions.

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".

Amir Administrator 0 Reputation points

2025-06-06T06:32:04.95+00:00

Hi I know this solution. But it works for ordinary task not for mismatch.

See attachment- difference between Entra (30 65 ** **) & AD (30 38 ** **)

There is no specific mobile nr. (30 65 ** **) that I can delete it.

And I can not delete it on Entra.

I can not find it (30 65 ** **) in AD and checked also Attribute to find any trace.
Anonymous

2025-06-09T08:35:52.03+00:00

Hello Amir Administrator

Synchronized users properties cannot be changed from Microsoft Entra ID or Microsoft 365 admin portals, neither through any available PowerShell modules. Up until recently, the exception to this was the Microsoft Entra user’s attributes called MobilePhone and AlternateMobilePhones.

These attributes are synchronized from on-premises Active Directory attributes mobile and otherMobile, respectively, but end users used to be able to update their own phone number in MobilePhone attribute in Microsoft Entra ID through their profile page. Changes to MobilePhone and AlternateMobilePhones attributes are no longer possible for Synchronized users except through the use of Microsoft Entra Connect or Microsoft Entra Cloud Sync.

When the Admin uses MsOnline or AzureAD PowerShell module or the user goes to MOP and updates the Mobile attribute, the updated phone number will be overwritten in Azure AD regardless of the object being synced from onpremises AD (DirSyncEnabled=true).

Along with this update, Azure AD also sets the attribute "DirSyncOverrides = Mobile (1)" on the object to flag that this user had a Mobile phone set from Azure AD. From
this point on, any update to the Mobile attribute coming from onpremises will simply be ignored by Azure AD as this attribute is no longer managed from on-prem AD.

We ran below commands to fix the issue,

Install-Module Microsoft.Graph

Connect-MgGraph -Scopes OnPremDirectorySynchronization.ReadWrite.All

$directorySynchronization = Get-MgDirectoryOnPremiseSynchronization

$directorySynchronization.Features.BypassDirSyncOverridesEnabled = $true

Update-MgDirectoryOnPremiseSynchronization -OnPremisesDirectorySynchronizationId $directorySynchronization.Id -Features $directorySynchronization.Features

Verify the status of the BypassDirSyncOverridesEnabled feature: (Get-MgDirectoryOnPremiseSynchronization).Features.BypassDirSyncOverridesEnabled

Once the feature is enabled, start a full synchronization cycle in Microsoft Entra Connect using the following command: Start-ADSyncSyncCycle -PolicyType Initial

You can refer to below article to get more information,

https://learn.microsoft.com/en-us/entra/identity/hybrid/connect/how-to-bypassdirsyncoverrides

Let us know if you have any further questions.
Anonymous

2025-06-10T04:42:28.66+00:00

Hello Amir Administrator

Just checking in to see if above information was helpful. If you have any further updates on this issue, please feel free to post back.
Amir Administrator 0 Reputation points

2025-06-16T07:08:14.21+00:00

Hi

Unfortunately we could not activate/use this service via PowerShell. But we have finally found a solution. Solution was simple. I have deactivated the user and moved it to any OU (with any policy for deactivated users). After sync I tried to reactivate the user and moved it back to original OU. So sync works again like before.

Answer 2

Amir Administrator 0

Hi

Unfortunately we could not activate this service via PowerShell. But we have finally found a solution. Solution was simple. I have deactivated the user and moved it to any OU (with any policy for deactivated users). After sync I tried to reactivate again and moved back to original OU. So sync works again like before.

Answer 3

Hello @Amir Administrator

Thanks for your response.

Good to hear that you were able to resolve your issue and thank you for posting your solution so that others experiencing the same thing can easily reference this!

Issue: Mismatch between AD & Azure

Solution:

Issue resolved by Amir Administrator

You have deactivated the user and moved it to any OU (with any policy for deactivated users). After sync I tried to reactivate the user and moved it back to original OU. So, sync works again like before.

Share via

Mismatch between AD & Azure

3 answers

Your answer