I have been working on a transition from Exchange 2010 to Office 365, doing a cutover conversion so that I can decommission my current Exchange Server.
The documentation, while there is a lot of it, is conflicting, misleading, and sometimes just wrong.
In any case, one of the most useful things I learned in this process was how to permanently delete MSOL users. Users that have been deleted and recreated with the same UserPrincipalName can cause all sorts of havoc.
Are you experiencing one of these problems:
- DirSync reports:
Unable to restore user from a deleted state because of following error(s):
Value 'xx@yy.com' for property 'UserPrincipalName' conflicts with another object in the directory.
Value ‘xx@yy.com’ for property 'ProxyAddress' conflicts with another object in the directory.
- Users can sign into https://portal.microsoftonline.com but not able to connect with a desktop client or mobile phone.
- Multiple users show up in your Global Address List (GAL)
- In Lync you see a the same user multiple times or you see deleted users
Well, all of these problems can be a result of deleting an account and recreating it with the same UserPrincipalName or ProxyAddress as the deleted version. Most documentation reports that the accounts will stick around for 30 days and there’s nothing you can do but wait or put a ticket into support. However, the latest version of MSOL PowerShell Tools has a fix—the latest is available from: http://onlinehelp.microsoft.com/Office365-enterprises/ff652560.aspx#BKMK_DownloadTheMOSIdentityFederationTool
The fix “Remove-MsolUser –RemoveFromRecycleBin –ObjectId ObjectId”
If you don’t have the “-RemoveFromRecycleBin” parameter option, then you are not using the latest version of MSOL PowerShell Tools.
To see if this is affecting a particular user, do the following in MSOL PowerShell
Connect-MSOLService Get-MsolUser –ReturnDeletedUsers –SearchString UserPrincipalName| select UserPrincipalName, ObjectId
The result will display all deleted mailbox containing the search string UserPrincipalName and their corresponding ObjectId’s.
To permanently delete one of the results, use the returned ObjectID in above statement in the Remove-MsolUser statement:
Remove-MsolUser -RemoveFromRecycleBin –ObjectId ObjectId
Note—this just deletes the already deleted mailbox from the recycling bin. It doesn’t do anything with the active (non-deleted) MsolUser if one happens to exist.
I ended up having a ton of deleted users from various failed attempts at migrating, and trying out SSO, so I wrote a simple PowerShell script to aid in the clearing out of deleted mailboxes. It should go without saying that if you do this, the deleted mailbox is no longer recoverable—it’s permanently deleted. For that reason, I have it show you the active user as a precaution so you can make sure the ObjectId that is about to be deleted permanently is not in fact the ObjectId of your currently active user. This script also prompts you twice to ensure you really want to permanently delete the MsolUser.
Param($searchString = $null)
function O365Logon
{
#Must be ran from MSOL Shell
Connect-MSOLService
}
function Main
{
if ($searchString -eq $null) {
$DeletedMailUsers = Get-MsolUser -ReturnDeletedUsers | select UserPrincipalName, ObjectId
} else {
$DeletedMailUsers = Get-MsolUser -SearchString $searchString -ReturnDeletedUsers | select UserPrincipalName, ObjectId
}
foreach($DeletedUser in $DeletedMailUsers) {
Write-Host "The active account for" $DeletedUser.UserPrincipalName " is:"
Get-MsolUser -UserPrincipalName $DeletedUser.UserPrincipalName | select ObjectId
$a = Read-Host Delete $DeletedUser.UserPrincipalName $DeletedUser.ObjectId ('y/n')?
if($a.ToLower() -eq 'y')
{
Remove-MsolUser -RemoveFromRecycleBin -ObjectId $DeletedUser.ObjectId
Write-Host "Removed User " $DeletedUser.ObjectId
}
}
}
O365Logon
Main
To run this script, copy and save the script in notepad as PermanentlyDeleteADeletedAccount.ps1 and start an Administrative MSOL PowerShell session.
The command syntax is:
.\PermanentlyDeleteADeletedAccount.ps1
or
.\PermanentlyDeleteADeletedAccount.ps1 UserPrincipalName
