Azure üzerinde herhangi bir kullanıcının immutableid değerini değiştirmek için aşağıdaki adımlar izlenebilir. Kullanıcı userprincipalname değeri ile direkt değiştirme işlemi yaptığınızda Set-MsolUser : You must provide a required property: Parameter name: FederatedUser.SourceAnchor hatasını göreceksiniz. Bu yüzden işlemi biraz değiştirmek gerekiyor. Senkron olmyan bir OU içine taşıyın ve ADSync işlemlerini yapınız. Daha sonra azure powershell üzerinde RestoreDeletedUsers klasöründen geri yükleme yapınız. Daha sonra aşağıdaki konutlar ile gerekli işlemleri yapınız.
Recently ran into an issue where a user in the on-prem AD had been deleted unintentionally and in the next sync his user went along with his mailbox.
Googling around I found a helpful article how to best go about restoring this. It’s basically about creating a new on-prem users and setting the new GUID on the recovered AzureAD user so AzureAD Connect can tie them together.
However, when trying to set the new “ImmutableID” with “set-msoluser” I got this error:Set-MsolUser : You must provide a required property: Parameter name: FederatedUser.SourceAnchor
Please, disable sync for account from active directory
If you want to set attribute, You should move to account to Not Sync Azure OU
Then, You can restore account from ReturnDeletedUsers
# Checking the original ImmutableID
get-msoluser -UserPrincipalName user@domain.com | select *immutableid*
# Changing it to a "onmicrosoft" UPN
set-MsolUserPrincipalName -UserPrincipalName user@domain.com -NewUserPrincipalName user@yourcompany.onmicrosoft.com
# Setting a new Immutable ID from on-prem AD
$Nimmutableid=[Convert]::ToBase64String([guid]::New($copieduser.ObjectGUID).ToByteArray())
set-MsolUser –UserPrincipalName user@yourcompany.onmicrosoft.com -ImmutableId $Nimmutableid
# Check that the change was applied
get-msoluser -UserPrincipalName user@yourcompany.onmicrosoft.com | select *immutableid*
# Changing it back to the original UPN
set-MsolUserPrincipalName -UserPrincipalName user@yourcompany.onmicrosoft.com -NewUserPrincipalName user@domain.com
# Checking that the UPN is now correct and the correct ImmutableID is applied
get-msoluser -UserPrincipalName user@domain.com | select *immutableid*