When a user leaves an organization, their account is usually deleted from Microsoft Entra ID. However, SharePoint often keeps a record of that user in its own databases. These records are commonly called orphaned users. Most of the time they do not cause any problems. But when the same user principal name (UPN) is later assigned to a new account, these orphaned records can cause the well-known User ID Mismatch issue. In this article, we’ll look at what orphaned users are, why they exist, how they are related to User ID Mismatch, and what SharePoint administrators can do about them.
Overview
An orphaned user in SharePoint is generally understood as a user whose record still exists in a SharePoint, even though the corresponding Microsoft Entra ID account no longer exists in directory.
Orphaned user records are not necessarily errors. SharePoint maintains its own databases at every site and caches user’s data so that it can preserve historical context, such as who created or modified a document. However, these records can become operationally significant when an organization creates a new Entra ID account using the same User Principal Name (or UPN), as a previously deleted account.
This can produce a SharePoint user ID mismatch:
- The old and new accounts have the same UPN, but different “internal” object IDs.
- SharePoint keeps the old UPN and still associates the UPN with the old identity.
- The newly created user receives permissions, but cannot access content (user id mismatch)
This article explains:
- What orphaned SharePoint users are.
- Why SharePoint retains them.
- How they contribute to user ID mismatch.
- Why fixing one affected site does not solve the tenant-wide problem.
- How remediation strategies differ by tenant size, tenant age, and employee turnover.
- How to approach the problem using cleanup, ticket prevention, and offboarding controls.
What Is an Orphaned User in SharePoint?
SharePoint maintains information about users who have interacted with or received permissions to a site collection. This information is stored in the site collection’s User Information List, commonly referred to as the UIL (it’s a hidden list in every SharePoint site collection). When a person visits a site or is otherwise resolved as a user, SharePoint caches information about that identity in this list. Deleting the corresponding account from Microsoft 365 or Entra ID does not necessarily remove the entry from each SharePoint UIL.
The resulting record is commonly called an “Orphaned user” or “Stale user” or “Legacy user” or “Orphaned SharePoint identity”. “Orphaned user” is a useful administrative term, although Microsoft documentation more frequently uses terms such as legacy user account, outdated user account, or an old entry in the UIL.
Why does SharePoint retain the user?
The retained record provides continuity for user-related metadata. For example, after an employee leaves the organization, other users may still need to see that the former employee:
- Created a document.
- Modified an item.
- Added a list entry.
- Was previously assigned permissions.
- Participated in historical SharePoint activity.
From this perspective, the orphaned record appears not harmless but useful. It helps SharePoint preserve the historical identity associated with existing content.
Should administrators treat every orphaned user as something that must immediately be deleted? I see Microsoft position is conflicting/controversial/ambiguous, as generally they say that legacy entry in the UIL is needed to preserve metadata but – at the same time – removal an orphan user from the UIL is OK, though primarily as a troubleshooting action for profile synchronization and mismatched-ID scenarios, rather than as routine indiscriminate cleanup (more: Is It Safe to Remove a User from a SharePoint UIL).
The Problem Appears When an Identity Is Recreated
Consider a common employee lifecycle scenario.
- John Smith leaves the organization.
- His Entra ID account is deleted.
- SharePoint retains John’s entries in the UIL of sites where he previously appeared.
- A year later, the organization hires another John Smith
- The identity team creates a new Entra ID account using the same UPN, such as
john.smith@contoso.com.
The new account looks similar to the old account: same display name, same email address, same UPN. However, it is not the same directory object. The recreated account receives a new internal identity value, even though its UPN matches the deleted account. Microsoft documents this as a primary cause of SharePoint and OneDrive user ID mismatch.
The same situation can also occur when the UPN is assigned to a rehired person.
From Entra ID’s perspective, the new account is a new security principal. From the affected SharePoint site’s perspective, however, the UPN may still be associated with the legacy UserInfo entry.
What Is a SharePoint User ID Mismatch?
A user ID mismatch occurs when the identity presented by the current user does not match the identity stored in SharePoint with the same UPN.
Conceptually, SharePoint sees something like this:
| Attribute | Legacy account | New account |
|---|---|---|
| Display name | John Smith | John Smith |
| UPN | john.smith@contoso.com | john.smith@contoso.com |
| Entra ID object ID | Unique (Old value) | Unique (New value) |
Although the UPN is the same, the internal identity is different.
Microsoft describes the underlying cause as follows: the recreated account receives a new ID, but the affected SharePoint or OneDrive UIL still contains the old ID. When the user attempts to access the site using the new account, the new identity does not match the identity stored in the site. Access can therefore be denied.
Sometimes a user experiences issues with their personal OneDrive site (User Id Mismatch in OneDrive scenario).
Typical symptoms include:
- An Access denied message, while permissions appear correct
- A message stating that a legacy account with the same email exists
Why Denying Existing Access Is Correct
At first glance, it may appear that SharePoint should automatically connect the new account to the old account because the UPN is identical. But that would create a security risk.
The same UPN does not mean that the new account represents the same person. Even if it is the same person, the individual may have returned in a different position, in another department, under different security requirements. So the new account should not automatically inherit the old account’s SharePoint permissions.
Therefore, SharePoint is correct not to treat the recreated account as the same security principal merely because the UPN matches. The more problematic behavior appears after an authorized site owner intentionally grants the new account access.
Where the Actual Operational Problem Begins
Suppose the new John Smith requests access to a site.
The site owner reviews the request and intentionally approves it. Alternatively, the site owner shares a site, library, folder, or document with the new account. From the site owner’s perspective, everything may appear correct:
- The expected name and email are displayed
- The user appears in the proper group (or with proper direct permissions)
- The sharing (or approval) operation completes without an obvious error
However, the user may still be unable to access the resource because the site’s UIL contains the legacy identity associated with the same UPN.
SharePoint does not replace the old identity automatically when the new account is granted access. That is the practical limitation behind the user ID mismatch incidents.
Microsoft’s supported starting point is the Site User Mismatch diagnostic in the Microsoft 365 admin center. When a mismatch is found, the diagnostic can offer to remove the old identity from the affected site. After the old entry is removed, the new account must be assigned the appropriate permissions.
For a single user and site, this is usually manageable. At tenant scale, it becomes much more complicated.
Why Fixing One Site Is Not Enough
A recreated user rarely interacted with only one SharePoint site. During the person’s previous employment, the account may have been present in:
- Many Team sites – as user can contribute to many projects, be involved in different activities
- Publishing (Communication sites) – as user access corporate intranet and other org-wide sites
- Shared OneDrive sites, as by default all documents shared in teams chats are shared via Onedrive
- Viva Engage connected sites, as there is a SharePoint site behind every community
Removing the legacy identity from one affected site fixes only that site. The same user may encounter another issue tomorrow, next week, or several months later when attempting to access a different site.
This creates a recurring support pattern:
- The user reports an access problem.
- The administrator identifies and fixes a mismatch issue at the reported affected affected site.
- The ticket is closed. User assumes his issue is fixed.
- The user encounters the same problem on another site.
- The investigation starts again. User is confused…
The technical fix is site-specific, while the identity lifecycle problem is potentially tenant-wide.
Why Discovering Every Affected Site Is Difficult
The obvious question is: Which SharePoint sites still contain the old identity?
SharePoint Online does not provide a simple out-of-the-box report listing every site collection whose UIL contains a specific legacy user. An administrator can technically scan SharePoint sites and inspect their users. However, this can be inefficient in a large tenant. For example, imagine a tenant with:
- 50,000 SharePoint sites.
- A user who appeared in approximately 100 of those sites.
A straightforward tenant scan may need to inspect all 50,000 sites to locate the relevant 100.
The administrator knows the identity being investigated but does not know which site collections contain that identity. SharePoint’s user information is distributed across site collections rather than exposed through a convenient centralized orphan-user inventory.
It is possible to use PowerShell, but even for one affected user, a tenant-wide brute-force scan may consume considerable time and service resources relative to the number of useful results. The other option is to use 3-rd party tools.
Shifting Left: When Should the Problem Be Addressed?
Can we be proactive here? Probably yes… There are three general opportunities.
Option 1: After a Ticket Is Reported for one site, fix all affected sites
This is a “reactive-proactive” approach… We get tickets (reactively) but fix not one, but all affected sites for a user (proactively)
Workflow
- A user reports that SharePoint access does not work.
- The administrator runs the Site User Mismatch diagnostic and confirms that the account was created with the re-used UPN and user experiences User Id Mismatch issue.
- The old user entry is removed from the reported site
- The administrator makes all efforts to identify all affected sites for the user, and fix these sites
- User is informed that the issue is fixed and that it must be a new share or approved access request
This approach is minimally proactive, it treats the symptom rather than the tenant-wide identity residue.
Option 2: Check Newly Created Accounts
The next shift-left opportunity occurs when an account is created. The idea is not to wait when user hits the issue. The organization could determine whether the UPN was previously used and then search for the corresponding legacy SharePoint identity, so the mismatch can be resolved before the user accesses SharePoint.
The challenge is the process must determine whether the UPN is genuinely new or reused. This approach can prevent tickets, but it requires reliable identity history.
Alternatively we can scan all new users to discover potential mismatched id, but this approach is much more expensive.
Option 3: Remove Legacy Site Entries During Offboarding
The earliest intervention point is employee offboarding.
Before deleting the Entra ID account, the organization still has a valid and identifiable user. It is easier to determine the SharePoint sites associated with a current identity than to reconstruct that information months or years later.
The offboarding process could be as follow:
- Disable user account
- Identify the SharePoint and OneDrive sites associated with the departing user
- Delete user account
- Remove the user from all sites UILs
Surely we know that most offboarded users will never return (deleted UPNs may never be reused) and removing every departing user from every site may be unnecessary, but it It addresses the problem at its earliest practical stage and ensures there is no future user ID mismatch incidents.
This is the most proactive approach, but it (as well as option 2) can also be an over-engineered solution if the actual mismatch rate is very low.
Again, as per Microsoft – an organization should not assume that universal deletion is automatically the best practice. Microsoft specifically describes UserInfo removal as a troubleshooting operation that should be performed for synchronization or mismatch scenarios when advised, rather than as a general cleanup requirement.
A Three-Workstream Strategy
For established tenants, a single activity not always completely solves the problem. A practical program can be a combination of three separate workstreams.
1. Clean Up Existing Orphaned Users
This workstream addresses the historical backlog already present in the tenant.
Imagine, we implemented remediation Option 3 (Remove Legacy Site Entries During Offboarding). For brand-new tenants that would guarantee no user id mismatch issues. But for mature tenants we already have a lot of legacy users, so we’ll definitely have issues related to mismatched is.
To ensure we do not have user id mismatch tickets – we wood need
– stop bleeding (implement Option 3 Remove Legacy Site Entries During Offboarding)
– clean-up existing orphaned users
Existing orphan users cleanup can require substantial effort in an old or large tenant because orphaned identities may have accumulated for many years, so we could have millions of orphaned users record (which means millions of deleting operations) – see more in “Estimate number of Orphaned Users and User Id Mismatch tickets.”
2. Stop Tickets
This workstream focuses on newly created or recreated accounts. Its purpose is to prevent a new employee or returning employee from encountering mismatch errors after receiving a Microsoft 365 account and before SharePoint access.
It does not remove the entire orphan-user backlog, so we’d still have a bunch of orphan users, but it can prevent visible incidents for newly created accounts. Having “Stop tickets” process implemented we guarantee user’s satisfaction, but that’s (imho) the most expensive process.
3. Stop the Bleeding
This workstream is triggered when users are offboarded. Its purpose is to prevent orphaned users, which would guarantee no new legacy identity conflicts. This is a future-state prevention activity.
Implementing “Stop Bleeding” process must be combined with clean-up efforts to achieve “Sop tickets”.
Imho, this is the most logical way to remediate the issue. It might be complicated from the engineering efforts perspective, but would be the less resource-consuming approach after clean-up.
Tenant Age aChanges the Priority
The appropriate combination of these workstreams depends partly on the age of the tenant.
New Tenant
A newly created tenant has little or no legacy identity history.
The primary focus should therefore be:
- Offboarding design
- “Brute force” clean-up efforts
Established (or Old) Tenant
An old established tenant with many years of account turnover already contain many unresolved legacy (orphan) users entries. We are probably dealing with existing (ongoing) user ID mismatch cases.
The organization may need all three workstreams:
- Clean up existing records
- Improve future offboarding
- Dealing with (or preventing) current tickets
Tenant Size Determines the Technical Approach
Small Tenants
In a small tenant, brute-force scanning may be acceptable. An administrator may be able to:
- Enumerate all SharePoint sites.
- Enumerate the users on each site.
- Compare SharePoint identities with Entra ID identities.
- Produce an orphan-user report.
- Review and remediate the results.
A simple PowerShell script can be used (like this one from the “Orphan Users in Small Tenants” ). Depending on throttling, number of sites, the process might complete within a practical operational window.
Large Tenants
In a large tenant, a simple brute-force approach is impractical. This is not only “this should be done” but “this should be done in a most effective way” otherwise it might take forever. The solution may require:
- Parallel processing with controlled concurrency
- Throttling and retry handling
- Delta-oriented identity processing
- Site prioritization
- Governance around retention and UPN reuse
At this scale, orphan-user management becomes an engineering and data-indexing problem rather than a simple administrative script. A 3-rd party tools might be required, in combination with custom PowerShell-based solutions.
Medium-Sized Tenants
To address an Orphaned Users and User Id Mismatch issue in a medium-sized tenant it may require a combination of approaches methods based on tenant size, age processes maturity, admins qualification and so on.
Employee Turnover Also Matters
Tenant size and age are not the only factors. Two organizations with the same number of users may experience very different levels of risk.
An organization with stable staffing and low turnover creates relatively few deleted identities. An organization that frequently hires contractors, seasonal workers, or temporary employees may create and delete a much larger number of accounts.
Is It Safe to Remove an Orphaned User?
This deserves its own detailed discussion.
Microsoft documents removal from the UIL as a way to troubleshoot mismatched identity and profile synchronization scenarios. At the same time, Microsoft warns that the removal procedure should be used for those troubleshooting purposes rather than as an unrestricted general cleanup method.
For additional analysis, see: Is It Safe to Remove a User from a SharePoint UIL
Another Way to Prevent User ID Mismatch: Identity Management
So far, we discussed the problem from a SharePoint administrator’s point of view. In that world, the typical solution is to find the legacy user in SharePoint and remove the old user entry from the User Information List.
However, there is another approach. Identity and Access Management (IAM) team can reduce or eliminate many User ID Mismatch issues by ensuring that each person receives a unique UPN that is never reused.
For example, instead of recreating:
john.smith@contoso.com
for a rehired employee, the organization could assign a different UPN, such as:
john_smith@contoso.com
or follow another naming standard that guarantees uniqueness.
With this approach, the new account never collides with the legacy SharePoint user record. As a result, User ID Mismatch issues do not occur.
Of course, this approach comes with its own challenges. Organizations often prefer to reuse the original UPN because it is easier for users, administrators, and business processes. In addition, changing naming standards may affect other systems that depend on predictable user names.
For that reason, UPN management should be viewed as an identity governance decision rather than a SharePoint administration task. SharePoint administrators can fix User ID Mismatch issues when they occur, but Identity and Access Management teams can often prevent those issues from appearing in the first place by implementing policies around account lifecycle management and UPN reuse.
In short, there are two ways to address User ID Mismatch:
- SharePoint approach: Find and remove the legacy SharePoint user records that cause the conflict.
- Identity management approach: Prevent UPN reuse so that the conflict never occurs.
The first approach is owned by SharePoint administrators. The second approach is owned by Identity and Access Management teams. In many organizations, the best long-term solution is a combination of both approaches.
Microsoft must address the issue
Anyway, the best possible resolution could be if Microsoft fix the product: at the moment when a new account is approved with access to the site (or site is shared by site owner with a user) – SharePoint can do clean-up internally – by replacing the old Id with the new Id.