In environments with multiple Azure AD Connect installations, sometimes, you experience unexpected behavior. For instance, when you want to change the source anchor from objectGUID to mS-DS-ConsistencyGuid for your Hybrid Identity implementation.
An organization leverages multiple Azure AD Connect installations. One installation is the actively synchronizing Azure AD Connect installation, the other installations are Staging Mode installations. Only the actively synchronizing installation performs exports to the connected Active Directory and Azure AD directories.
All Azure AD Connect installations were initially configured with the objectGUID attribute as the source anchor. The source anchor was not migrated to the mS-DS-ConsistencyGuid attribute till date.
Changing the source anchor requires running the Configure Source Anchor task in an Azure AD Connect installation. Then, you need to make the same changes on the Staging Mode servers as well.
However, when running the Configure Source Anchor task on the (first) Azure AD Connect Staging Mode server, you receive the following error:
The error is caused, because Azure AD Connect checks the contents of the mS-DS-ConsistencyGuid attribute of objects in scope to see if no other application, system or service uses the attribute. Overwriting these values could potentially be catastrophic for these solutions.
The actively synchronizing Azure AD Connect installation is the service that writes values in the mS-DS-ConsistencyGuid attribute. As a Staging Mode Azure AD Connect installation doesn’t perform export actions, it does not actually write to the mS-DS-ConsistencyGuid attribute. Therefore, the issue can be safely ignored, and Azure AD Connect can be instructed to do so.
On the Staging Mode server(s) we need to start Azure AD Connect differently. Instead of starting AzureADConnect.exe from the Desktop or Start Screen, we need to start it from an elevated Command Prompt window with the following two commands:
cd C:\Program Files\Microsoft Azure Active Directory Connect
Then, we can run the Configure Source Anchor task without the error.
A Staging Mode server checks the contents of the mS-DS-ConsistencyGuid attribute, as it has no knowledge of any actively synchronizing Azure AD Connect installation. This information is not provided from the endpoints that Azure AD Connect communicates with, although they could…
Using ms-DS-ConsistencyGuid as sourceAnchor
Explained: User Hard Matching and Soft Matching in Azure AD Connect
Azure AD Connect: objectGUID vs. mS-DS-ConsistencyGuid, Part 1
Azure AD Connect: objectGUID vs. mS-DS-ConsistencyGuid, Part 2
Azure AD Connect: objectGUID vs. mS-DS-ConsistencyGuid, Part 3
Azure AD Connect v188.8.131.52 brings mS-DS-ConsistencyGUID as source anchor for Groups