---
tags:
  - 🏷️topic/💾software/azure
  - 🏷️topic/💾software/m365
  - 🏷️topic/⌗shell/powershell
  - 🚩purpose/🗺️guide
  - 🏷️topic/💾software/azure/aad
---
Cloud-only accounts that have previously had an on-premises account associated with them may still have an `immutableId` property set on their AAD user. This is a unique value that identifies an on-premises AD account by base64-encoding an AD account’s `objectGuid`. If `immutableId` is already set, no other account can be synced under the same UPN or email address, both unintentionally as a result of username or email clashing, or intentionally to fix unsynced accounts [like Microsoft recommends](https://support.microsoft.com/topic/75673b94-e1b8-8a9e-c413-ee5a2a1a6a78).

The `immutableId` value normally cannot be set by any AAD/Office 365/Microsoft 365 web interfaces, toolkits, or cmdlets; but Microsoft Graph can for some reason. You can assign it like so:
```powershell
Update-MgUser -UserId 'myuser@contoso.com' -OnPremisesImmutableId ([Convert]::ToBase64String([guid]::New((Get-ADUser myuser123).objectGuid).ToByteArray()))
```

# Source
https://www.easy365manager.com/how-to-hard-match-a-user-in-office-365/