OnPremisesImmutableId and OnPremisesObjectIdentifier

[Varun Pareek (varun-pareek-robomq)]

When I see the manual provisioning logs , I see that OnPremisesObjectIdentifier is carrying the encoded value of ObjectGUID from ON-PREM AD, though it should contain the raw ObjectGUID, moreover I can see in the Properties tab of User on Entra ID, there is no attribute as 'OnPremisesObjectIdentifier', instead we find the encoded GUID under OnPremisesImmutableId, is this a problem at my end, how attribute mapping is done? or Microsoft handles them internally?

[Rakesh Randeria (rakeshranderia)]

onPremisesObjectIdentifier = the on-prem AD objectid used by hybrid sync and corresponds to the AD objectGUID.

onPremisesImmutableId is the used to associate the on-premises AD account with the Entra user object. Depending on the sync config, that value may be an encoded string rather than the AD GUID

MS Doesn't expose the onPremisesObjectIdentifier in properties so I wouldn't worry about that

Validate the values through Graph
Get-MgUser -UserId user@contoso.com
-Property Id,DisplayName,OnPremisesImmutableId,OnPremisesObjectIdentifier,OnPremisesSyncEnabled |
Select-Object Id,DisplayName,OnPremisesImmutableId,OnPremisesObjectIdentifier,OnPremisesSyncEnabled
`

Confirm what attribute is configured as the source anchor, it may be ms-DS-ConsistencyGuid rather than raw objectGUID, which could explain why onPremisesImmutableId doesn't match AD GUID

MS Reference 1
MS Reference 2