--- title: "How Are Users Matched Between Active Directory and Entra ID" canonical: "https://docs.certero.com/space/CUP/326336576/How%20Are%20Users%20Matched%20Between%20Active%20Directory%20and%20Entra%20ID" format: markdown --- --- ## Overview In a hybrid deployment, the same person usually exists in both Active Directory and Microsoft Entra ID. CerteroX needs to recognise those two directory records as one person, so that the solution holds a single record rather than two. This article explains how that matching works, and what happens when it does not. --- ## The Matching Sequence When the Entra ID connector processes a user, it attempts to match them to an existing person in this order. The first match wins. | **Order** | **Match on** | **Applies when** | | --- | --- | --- | | **1** | The Entra user's unique identifier. | The user has been collected by a previous Entra connector run. | | **2** | The Entra user's on-premises immutable identifier, matched to the Active Directory account. | The user is synchronised from Active Directory to Entra by Microsoft Entra Connect. | | **3** | The Entra user's on-premises account name **and** domain name, matched to the equivalent Active Directory account. | The user has on-premises attributes but the immutable identifier could not be used. | > ℹ️ If none of the three produces a match, the user is treated as new and a new person record is created. --- ## What this means in Practice **For synchronized users**, matching is reliable. Microsoft Entra Connect populates the on-premises attributes that steps 2 and 3 depend on, so a user synchronized from Active Directory to Entra will be recognised as the same person. **For cloud-only users**, there is nothing to match against in Active Directory, and a new person record is created. This is correct, they genuinely are a person that Active Directory does not know about. **For users who exist in both directories but are not synchronized**, matching may fail. Where a user was created independently in Entra rather than being synchronized from Active Directory, they carry no on-premises attributes, and the platform has no reliable basis on which to connect the two records. The result is two person records for one human being. --- ## Preparing for a Good Match rate The quality of matching depends almost entirely on your directory data rather than on CerteroX. Before enabling the Entra ID connector in a hybrid deployment, it is worth confirming: - **Microsoft Entra Connect is synchronizing the users you expect it to.** Users in scope for synchronization match reliably; users outside that scope will not. - **You know which accounts are deliberately cloud-only.** Service accounts, contractors and external identities are often created directly in Entra. These will produce new person records, which is the correct outcome, but it is better to expect them than to discover them. - **Your Active Directory domain names in Certero are current.** Step 3 of the matching sequence depends on the domain name recorded against the Active Directory account. --- ## After the First run Review your user list once the Entra ID connector has completed its first collection. The figure worth checking is the total number of people before and after, a rise roughly equal to your known cloud-only population is expected. A materially larger rise suggests matching has not worked as intended for some users. See *[Duplicate User Records | After Enabling the Entra ID Connector](https://helpdesk.certero.com/space/KCS/326172773/Duplicate+User+Records+%7C+After+Enabling+the+Entra+ID+Connector)* if you find unexpected duplicates. --- ## Which Directory Supplies the data once Matched? Matching decides *whether two records are the same person*. It does not decide *which directory's values are used*, that is governed separately by your Preferred Directory Source setting. See *[Setting your Preferred Directory Source](https://docs.certero.com/space/CUP/326336556/Setting+your+Preferred+Directory+Source)**.* --- ## Getting Started / Support If you have questions or need help, please contact the **Certero Help Desk** or your Certero account team. --- © 2026 Certero Company Confidential. All rights reserved.