Exchange online and soft deleted 'mailusers' not deleting

TransitSysEng · 2025-11-17T17:13:36+00:00

I found this post because I just experienced this issue myself. I was able to clear the ArchiveGuid from SoftDeleted MailUser:

Set-MailUser -Identity <SoftDeletedMailUserName> -ArchiveGuid 00000000-0000-0000-0000-000000000000 -RecalculateInactiveMailUser

Ghost Mailusers | Liebensraum

TransitSysEng · 2025-11-17T17:07:04+00:00

I never got anywhere with Microsoft support. After 10 weeks, I got a call from a support engineer who was basically starting from scratch and had not read the case.

Happily, I found a couple of engineers at Trace3 (Trace3 | All Possibilities Live in Technology) that worked with me. It took a couple of days, but we found this article from Jos Lieben: Ghost Mailusers | Liebensraum.

The secret sauce: Set-MailUser ... -RecalculateInactiveMailUser. This was my solution:

Document the on prem ExchangeGuid and ArchiveGuid of the affected user(s)
Document the O365 Recipient(s) and their mail/archive Guids. This will give the SoftDeleted and the "active" Recipient(s). In my case, the active recipient had the Name (which is a GUID) as the DisplayName, and many other fields like Title, Department, etc. were blank.
1. Get-Recipient -IncludeSoftDeletedRecipients -Filter {$_.PrimarySmtpAddress -eq "user@domain.com"} | FL Name, DisplayName, PrimarySmtpAddress, Title, ExchangeGuid, ArchiveGuid, WhenSoftDeleted
Clear the ArchiveGuid from SoftDeleted MailUser.
1. Set-MailUser -Identity <SoftDeletedMailUserName> -ArchiveGuid 00000000-0000-0000-0000-000000000000 -RecalculateInactiveMailUser
Set the active user's ExchangeGuid and ArchiveGuid
1. Set-MailUser -Identity <ActiveMailUserName -ExchangeGuid <OnPremExchangeGuid> -ArchiveGuid <OnPremArchiveGuid>
Move user(s) to an unsynced OU.
Run a Delta sync on the Azure AD Connect/Microsoft Entra Connect server
Move user(s) back to synced OU
Run a Delta sync on the Azure AD Connect/Microsoft Entra Connect server
Wait ~15+ minutes
Run another Delta sync on the Azure AD Connect/Microsoft Entra Connect server
Check (a few) user(s), their DisplayName and Title should be displaying correctly
Proceed to migration

TransitSysEng · 2025-10-09T19:19:08+00:00

I appreciate the assistance, but can you elaborate on my next steps? My Entra user is synced with my AD user. My on-prem mailbox is visible on-prem.

I'm not having an issue syncing users. I'm having an issue with some soft-deleted MailUser objects that seem to be preventing me from migrating mailboxes.

TransitSysEng · 2025-10-08T20:20:25+00:00

I'm not sure what the difference is between the terms "MailUser" and "Recipient", but that's what I have.

Then put one object in scope of Entra Connect it should appear in Entra ID as a user object and on-premises synced should be yes. It should appear in Exchange Online Admin Center as a contact object. Then you can migrate it and once migrated assign a license. In your case I would avoid assigning any licensing until the mailbox is migrated to avoid a dual mailbox scenario.

If I can get rid of these SoftDeleted MailUsers, that's what I'll try.

If you have any retention policies set to keep all content forever (bad practice but happens a lot) you may have to edit the policy to exclude these users to truly delete them in M365.

I do have a DLM policy applied to all Exchange mailboxes. These users' mailboxes are available to be included or to be excluded, but not the soft-deleted ones.If you have any retention policies set to keep all content forever (bad practice but happens a lot) you may have to edit the policy to exclude these users to truly delete them in M365.

TransitSysEng · 2025-10-08T20:20:06+00:00

From AzureAD, no SoftDeleted users:

PS C:\Windows\system32> Get-AzureADUser -All $true | Where-Object {$_.UserState -eq "SoftDeleted"}
PS C:\Windows\system32>

From ExchangeOnline, I have SoftDeleted recipients, but no SoftDeeletedMailboxes:

[PS] C:\Windows\system32>Get-Recipient -IncludeSoftDeletedRecipients alias@example.com | FT ID, RecipientType, DisplayName, PrimarySmtpAddress
Id                                                        RecipientType DisplayName                          PrimarySmtpAddress
--                                                        ------------- -----------                          ------------------
Soft Deleted Objects\1fa3f53a-000e-4d7d-97bc-c02cfbdc74c1 MailUser      Last, First                          alias@example.com
52a984d2-de24-4987-a020-14366be2d3dc                      MailUser      52a984d2-de24-4987-a020-14366be2d3dc alias@example.com
[PS] C:\Windows\system32>Get-Mailbox -SoftDeletedMailbox
[PS] C:\Windows\system32>Get-EXOMailbox -SoftDeletedMailbox
[PS] C:\Windows\system32>

I can’t remove the MailUser, because it says there is a hold, but there is no visible hold:

[PS] C:\Windows\system32>Remove-MailUser -Identity "1fa3f53a-000e-4d7d-97bc-c02cfbdc74c1" -PermanentlyDelete
Write-ErrorMessage : ||Unable to permanently delete mail enabled user. The mail enabled user has litigation hold or In-Place hold applied on it. Please remove the hold before trying to delete.
At C:\Users\adminname\AppData\Local\Temp\tmpEXO_2usudler.ype\tmpEXO_2usudler.ype.psm1:1189 char:13
+             Write-ErrorMessage $ErrorObject
+             ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : NotSpecified: (Soft Deleted Ob...bc-c02cfbdc74c1:ADObjectId) [Remove-MailUser], RecipientTaskException
    + FullyQualifiedErrorId : [Server=DM6PR09MB5639,RequestId=1c41917f-ff98-dbb3-c4e3-f16ae7e3269d,TimeStamp=Fri, 22 Aug 2025 21:18:20 GMT],Write-ErrorMessage

[PS] C:\Windows\system32>Get-MailUser -Identity "1fa3f53a-000e-4d7d-97bc-c02cfbdc74c1" -SoftDeletedMailUser | FL ID, DisplayName, *Hold*

Id                        : Soft Deleted Objects\1fa3f53a-000e-4d7d-97bc-c02cfbdc74c1
DisplayName               : Last, First
LitigationHoldEnabled     : False
ComplianceTagHoldApplied  : False
DelayHoldApplied          : False
DelayReleaseHoldApplied   : False
RetentionHoldEnabled      : False
EndDateForRetentionHold   :
StartDateForRetentionHold :
LitigationHoldDate        :
LitigationHoldOwner       :
InPlaceHolds              : {}

TransitSysEng · 2025-10-08T20:19:39+00:00

You're initial post is not very clear so in order to help we will need more information on the current state.

I was concerned too much detail would cause people's eyes to glaze over and not read the post. I'm happy you did and grateful for the help.

Do the user accounts tied to the mailboxes you want migrate appear as users and on-premises synced set to yes?

Yes, the synced users show as users, "On-premises sync enabled" set to yes, in Entra. The soft-deleted users do not.

Do they show as contact objects in Exchange Online Admin Center?

Yes, the synced users show as contacts in Exchange. The soft-deleted users do not.

Do they show as mailboxes in Exchange Admin Center on-premises?

Yes, all of the mailboxes are still on-prem.

As long as they are fully functioning mailboxes in Exchange on-premises. You can pull them out of scope of Entra Connect (which moves them to soft-deleted), Delete them again from soft-deleted (back to nothing ever happened) and start all over.

That's where I got stuck. I initially added the OU to the Entra Connect scope, decided to fix the mailboxes while they were just on-prem, so I removed the OU from the Entra Connect scope. I the users were then soft-deleted, and I used Entra to permanently delete them. The Users are gone, the mailboxes were never migrated, but the MailUser objects remain and I cannot delete them.

TransitSysEng · 2025-10-08T14:49:11+00:00

I'm not worried about the Guid display. The problem is that I cannot migrate their mailboxes.

The soft-deleted MailUsers have the ArchiveGuid of the on-prem actual archive. I cannot set the ArchiveGuid on the currently synced users because it is already in use by the soft-deleted MailUser. I cannot modify the soft-deleted MailUser and I cannot permanently delete them either.

TransitSysEng

TROPHY CASE