Problem

Provisioning fails for a user with one of the following:

  • primary_email "A user with this email address already exists." (duplicate_value)
  • external_id "A user with this external ID already exists." (duplicate_value)
  • 409 Conflict

Cause

  • A profile with that email already exists in Freshservice (often an old, deactivated or duplicate profile).
  • After a reinstall or an email change, Microsoft Entra ID lost the stored Freshservice IDs and tries to create users that already exist.

Steps

  1. In Freshservice, search the conflicting email in Agents and Requesters.
  2. If a profile exists and it is a duplicate, change its email to a placeholder, or use Forget User if you no longer need it.
  3. Run Provision on demand for the user (see How to Test One User with Provision on Demand).
  4. After a reinstall, run a second full cycle with Restart provisioning. Users should then be matched and updated instead of created.
  5. Keep the externalId mapping.

If the conflict stays

Sometimes the error says a user exists, but you cannot find any profile with that email in Freshservice. A record is then held in the background, and it cannot be removed from the Freshservice screens. The same applies if many users fail with the same error at once, or a rehired user stays blocked. In these cases, raise a request and include your Freshservice URL, the exact error text and the affected email addresses from the provisioning log. Do not edit external IDs in bulk.

Sources

  • KB: Duplicate Users After an Email Change: How to Fix
  • KB: How to Read Provisioning Logs and Find the Cause of an Error