Microsoft 365 anchors (ImmutableID and UPN)

Microsoft Entra identifies the person in a federated sign-in by the ImmutableID. This service keeps one anchor per person and federation. A person without an anchor sees «Your account is not enabled for Microsoft 365 sign-in. Ask your administrator for a Microsoft 365 anchor.» and nothing is sent to Microsoft.

Cloud-only users (no Active Directory)

They have no ImmutableID; the service generates one.

1. In the federation, under «Anchors (ImmutableID and UPN)», choose «Generate for users without an anchor». Each active person with an email in the domain gets UPN = email and a random ImmutableID.
2. If the Microsoft UPN differs from the email, use «Import anchors» with upn,,email lines (an empty ImmutableID is generated).
3. Download and run the script before federating the domain: the script writes the ImmutableIDs into Entra.

People created after the domain is federated: per Microsoft's documentation, Entra does not let you change a federated user's ImmutableID. Create the user with the anchor already, or temporarily change the UPN to onmicrosoft.com, write the anchor and switch back. The script detects this case and stops before changing the federation.

Hybrid users (synchronised from Active Directory)

Entra already has their anchor: import it instead of generating it. Export userPrincipalName, onPremisesImmutableId and the email with Microsoft Graph PowerShell and paste the upn,immutableId,email lines into «Import anchors».

Import rules

• Up to 500 lines per import, all or nothing.
• Problems are listed line by line: «unknown user», «UPN outside the federated domain», «appears twice», «UPN or ImmutableID used by another person», «already has an anchor», «malformed line». Nothing is saved if there is one.
• UPNs and ImmutableIDs with an apostrophe are refused.

After saving: «Download the setup script again before you run it.»