EXO Litigation Hold Operation Failing Due to Duplicate Object Match

IdentityIQ (IIQ) IIQ Discussion and Questions
1

Which IIQ version are you inquiring about?

8.4

Please share any images or screenshots, if relevant.

N/A

Please share any other relevant files that may be required (for example, logs).

We are seeing the following error multiple times in IdentityIQ (IIQ):

“The operation couldn’t be performed because object: ‘[display name of user]’ matches multiple entries.”

Share all details about your problem, including any error messages you may have received.

Based on our investigation, this appears during the termination process, specifically when IdentityIQ attempts to set the litigation hold in Exchange Online (EXO).
At this point, we suspect that the issue may be originating on the Azure AD side, rather than from the IdentityIQ form or workflow itself.

If the issue is determined to be related to the IdentityIQ connector or a known product defect, please confirm this and provide the applicable eFix, including the recommended version/patch level and any relevant implementation guidance.

If there is any recommended configuration or workaround in IdentityIQ to ensure the operation targets the correct account/object rather than relying on a potentially non-unique attribute, please let us know.

2

This error generally indicates that the identifier being used resolves to more than one object in the directory. What account identifier are you using for your Azure accounts? Have you gathered any operations logs to confirm the operation parameters being passed? Have you tested the operation manually against a known problem account?

3

Adding to @ryan_coulter , if you run Get-Recipient -Identity "<display name>" in EXO PowerShell for one of the affected users, does it return more than one object?

4

@arumuk04 Possibly display name is being used as the identifier for the EXO and it is not unique, must be returning multiple users sharing the same display name. Please review your application integrated in IIQ and see what is the native identity.. If it is set to display name, please change it to something unique, like UPN or ExchangeObjectId.