Resolving Exchange Online Mailbox Recovery Failure Due to UPN Conflict After Re-Licensing
The issue leads to mailbox conflicts, preventing proper reattachment and data recovery.
🔍 The Symptoms / Error Message
⚠️ What You May Experience
- Mailbox is not provisioned even after license assignment
- OR “The mailbox associated with this user cannot be found”
- OR Restored user is assigned a prefixed UPN (e.g.,
user_domain#EXT#@tenant.onmicrosoft.comorRecovered_<GUID>)
🧠 Root Cause
💡 Why This Happens
When a Microsoft 365 user account loses its Exchange Online license, the mailbox is soft-deleted after the retention period (typically 30 days). If instead of restoring the original account, a new account is created using the same UPN, the following happens:
- The original mailbox still exists in a soft-deleted state
- The new account has no linkage to the original mailbox
- Attempting to restore the original account results in a UPN conflict
- Exchange assigns a temporary or prefixed UPN, preventing mailbox reattachment
This breaks the identity-to-mailbox association in Exchange Online.
🛠️ Step-by-Step Resolution
Identify the Conflict
Check for soft-deleted mailboxes and confirm the state of the existing active account using Exchange Online PowerShell.
Connect-ExchangeOnline -UserPrincipalName admin@yourdomain.com # Check for soft-deleted mailboxes Get-Mailbox -SoftDeletedMailbox | Format-Table Name,UserPrincipalName,WhenSoftDeleted # Check existing active account Get-Mailbox -Identity user@yourdomain.com
Restore the Original User Account
Use Microsoft Graph PowerShell to locate the deleted user object and restore it before resolving the UPN conflict.
Connect-MgGraph -Scopes User.ReadWrite.All,Directory.ReadWrite.All # Find deleted users Get-MgDirectoryDeletedItem -All | Where-Object {$_.UserPrincipalName -eq "user@yourdomain.com"} # Restore the original user Restore-MgDirectoryDeletedItem -DirectoryObjectId <DeletedUserObjectId>
⚠️ Note
After restoration, the user may have a modified UPN due to duplication.
Resolve the UPN Conflict
Identify the new duplicate account and the restored original account, then rename and reassign the correct UPN.
✅ Resolution Steps
- Identify the new duplicate account and the restored original account
- Rename the new duplicate account to a temporary UPN
- Reassign the correct UPN to the restored original account
# Rename the new duplicate account Update-MgUser -UserId <new-user-object-id> -UserPrincipalName temp_user@yourdomain.com # Reassign correct UPN to the restored original account Update-MgUser -UserId <restored-user-object-id> -UserPrincipalName user@yourdomain.com
Reassign the Exchange License
Once the UPN conflict is resolved, reassign the Exchange Online license to the restored account.
# Assign Exchange Online license Set-MgUserLicense -UserId <restored-user-object-id> -AddLicenses @{SkuId="<SKU-ID>"} -RemoveLicenses @()
Validate Mailbox Recovery
Confirm the mailbox is now active and properly attached to the restored account.
# Confirm mailbox is now active and attached Get-Mailbox -Identity user@yourdomain.com # Check mailbox status Get-MailboxStatistics -Identity user@yourdomain.com | Format-List DisplayName,ItemCount,TotalItemSize
✅ Validation
Expected output: mailbox shows as active and attached, with item count and total item size matching the original mailbox data.
💡 Best Practices & Recommendations
- Always restore users instead of recreating accounts when reassigning licenses
- Avoid reusing UPNs until confirming no soft-deleted objects exist
- Implement regular monitoring of license removals to avoid unintended mailbox deletions
- Use retention policies to protect mailbox data beyond 30 days
✅ Key Takeaway
Mailbox recovery failures after license reassignment are almost always caused by identity duplication and UPN conflicts. The correct approach is to restore the original account, resolve identity conflicts, and then reapply licensing — not recreate users.
📚 References & Further Reading
- 🔗 Delete or restore mailboxes — Microsoft Learn
- 🔗 Soft-deleted mailboxes — Microsoft Learn