Transition from Active Directory to Entra ID

If your organization is moving identity management from on-premises Active Directory to Microsoft Entra ID, the sync transition in MyQ requires careful preparation. The core challenge is that AD-synced and Entra ID-synced users are identified by different attributes – sAMAccountName for AD, UPN for Entra ID – and these values are rarely identical. Without preparation, running an Entra ID sync against an existing AD-synced user population will create duplicate accounts rather than updating existing ones.

This article covers how to prevent that, and how to choose the right approach for your environment.

Why This Requires Preparation

MyQ uses sAMAccountName as the username for AD-synced users – for example, tim.canterbury. It uses userPrincipalName (UPN) as the username for Entra ID-synced users – for example, tim.canterbury@acme.com. These are two different values. By default, MyQ matches synchronized users by username and synchronization source. Because AD and Entra ID normally produce different usernames, an Entra ID sync cannot automatically match existing AD-synchronized users without additional preparation.

When you run an Entra ID sync against users already in MyQ with AD-sourced usernames, MyQ cannot match them – the usernames differ – and creates new accounts instead. The result is duplicate users, with the new accounts having no history: no credits, no quotas, no pending jobs.

The three options below each solve this by ensuring the identities can be matched before the Entra ID sync runs.

Understanding Synchronization Sources

Before choosing an option, it's important to understand how MyQ uses synchronization source names to match and update users.

Each synchronization source has a name. By default, MyQ will only update users that were imported by a source with the same name. If your AD source is named "AD" and your new Entra ID source is named "Entra ID", the Entra ID sync will not update the AD users – it will create new ones.

Two settings control this behavior:

Synchronization source name: acts as a marker identifying which users belong to which source. To allow an Entra ID source to update users previously imported by an AD source, either give both sources the same name, or use the option below.

Ignore synchronization source: when enabled, the sync source considers all users in MyQ, regardless of which source imported them. This allows any source to update any user when usernames match.

Determine Your Environment

Option 1 – Normalize Users With CSV and Update From Entra ID

This option works in all environments. It involves exporting existing users, rewriting their usernames to UPN format in a CSV file, re-importing to update them, and then running the Entra ID sync.

Prerequisites

Users must have personal numbers in MyQ before you start – these are used to pair the CSV import with existing accounts, since usernames will change. If users don't have personal numbers yet, either synchronize them from AD (via the Personal number mapping in the LDAP sync source) or add them manually. To add them manually: export users from the Users page (Tools – Export), add a unique value to the CODE column for each user, and re-import.

Steps

1. On the Users page, select Tools – Export and download the CSV.

2. In the CSV, rewrite all usernames to the UPN format used by Entra ID. For example, timcanterbury → tim.canterbury@acme.com. Leave personal numbers unchanged.

3. In Settings – User Synchronization, add the modified CSV as a new synchronization source.

   • Set the synchronization source name to match your existing AD source name, or enable Ignore synchronization source.

   • Enable Pair by the personal number.

4. Run the synchronization. Usernames in MyQ will now match UPNs in Entra ID.

5. Create the Entra ID synchronization source, setting its name to match the AD source or enabling Ignore synchronization source.

6. Run the Entra ID synchronization. Existing users will be updated, not duplicated.

Successful matches are logged as Match via LOGIN.

Option 2 – Append Domain to Usernames and Update From Entra ID

This option is available only when appending the configured domain to the AD sAMAccountName produces exactly the same value as the user's Entra ID UPN.

For example:
tim.canterbury → tim.canterbury@acme.com

Steps

1. In the AD synchronization source settings, enable Append domain to username and run the synchronization. Usernames will change from tim.canterbury to tim.canterbury@acme.com.

2. Create the Entra ID synchronization source, setting its name to match the AD source or enabling Ignore synchronization source.

3. Run the Entra ID synchronization. Users will be matched by the now-identical usernames and updated.

4. Once confirmed, remove the AD synchronization source and continue syncing from Entra ID only.

Option 3 – Match Users via Personal Number

This option uses the Personal number field as a shared identifier between AD and Entra ID, bypassing the username mismatch entirely.

Two common scenarios apply:

• Users in AD already have a personal number attribute (such as employeeId) that is also present in Entra ID.

• No personal number exists, but another unique and stable attribute that has the same value in both directories, such as an employee ID, email address, or UPN, can be mapped temporarily to Personal number for the transition.

Steps

1. In the AD synchronization source, map the chosen attribute to the Personal number field on the Users tab. If using userPrincipalName, this syncs the user's UPN from AD into MyQ's personal number field.

2. Run the AD synchronization to populate personal numbers.

3. Check a sample of users to confirm the Personal number field is populated correctly before proceeding.

4. Create the Entra ID synchronization source. Enable Pair by the personal number and map the same attribute to the Personal number field. Set the synchronization source name to match the AD source or enable Ignore synchronization source.

5. Run the Entra ID synchronization. Users will be matched via personal number and updated.

Note that the Personal number attribute in Entra ID does not need to be one of the listed options in the dropdown – you can type any attribute name manually and it will be used.

After the Transition

Once users are successfully updated from Entra ID, remove or disable the AD synchronization source to prevent it from overwriting Entra ID-managed users on subsequent runs. Monitor the User Synchronization log after the first few scheduled runs to confirm users are being updated as expected rather than duplicated.