This is a scenario every admin running hybrid identity with Microsoft Entra Connect Sync eventually runs into. Someone deletes an on premises Active Directory user, whether by mistake or as part of an offboarding, and then a new account needs to be created for that same person shortly after, perhaps because they were rehired or the deletion was premature. The instinct is to just create a fresh AD account with the same name. That is exactly what causes the sync problems.
Why recreating from scratch breaks the sync
Microsoft Entra Connect Sync matches an on premises AD user to its corresponding Microsoft Entra ID (formerly Azure AD) object using a source anchor, most commonly the ms-DS-ConsistencyGuid attribute. A brand new AD account, even with an identical name and email address, gets a brand new GUID. Entra Connect has no way to know it is meant to represent the same person as the old, now deleted account, so instead of reconnecting to the existing cloud user, it tries to create a second, duplicate cloud identity, which usually surfaces as a sync error rather than a clean new account.
The simplest fix, if you catch it in time
If Active Directory Recycle Bin is enabled in your environment and the deletion happened recently, restoring the original deleted AD object rather than creating a new one is by far the cleanest path. A restored object keeps its original identifiers, so Entra Connect reconnects it to the existing cloud user automatically on the next sync cycle, with no manual matching required.
If the account has already been recreated
If a new AD account already exists and simply restoring the old one is no longer an option, the fix is a manual hard match: you need the new on premises account's source anchor to equal the existing cloud user's Immutable ID. In Microsoft Graph PowerShell, you can retrieve the existing cloud user's Immutable ID with:
Get-MgUser -UserId "user@yourdomain.com" -Property onPremisesImmutableId | Select-Object onPremisesImmutableId
That value then needs to be converted and stamped onto the new AD object's ms-DS-ConsistencyGuid attribute so the two match exactly, after which a delta sync on the Entra Connect server, triggered with Start-ADSyncSyncCycle -PolicyType Delta, allows Entra ID to reconnect the accounts.
The exact byte conversion between an Immutable ID and a matching ms-DS-ConsistencyGuid value is easy to get subtly wrong, and getting it wrong on a production identity can create a messier problem than the one you started with. If you are not doing this regularly, it is worth having a second set of eyes on it, or working with a partner who does this often, before you touch a live directory.
Identity and directory sync issues are exactly where a small mistake can ripple out to mailboxes, Teams, and SharePoint access all at once. Our Microsoft 365 team handles this kind of hybrid identity troubleshooting regularly. Get in touch before you recreate an account you might need to hard match later.