Move-AdmObject Cannot find object: A referral was returned from server

Question

I am running the following PowerShell script that moves an object from one OU to another in our Entra tenant.

Note this is an Entra id guest account that exists. It finds the account using Get-AdmObject by UPN. The distinguished name reference is correct as the target OU.

Is the path syntax different because its a container vs an OU? I have tried using the distinguished name, adsPath and objectGuid of the target location object with the same results.

But when I try to move the object to the new OU, it returns the following error:

$upn = "email_domain.com#EXT#@domain.onmicrosoft.com"

<# Only used to get the domain object #>
$domainDN = "%distinguishedName%"
$domain = $Context.GetObjectDomain($domainDN)

$Context.LogMessage("$domain", "Information")

<# works getting user by upn on domain #>
try {
    $user = Get-AdmObject -Filter {userPrincipalName -eq $upn} -Server $domain -AdaxesService localhost                
}
catch [System.Exception] {
    $Context.LogException("Error: Get-AdmUser threw exception when trying to find guest user by UPN")        
}

 <# adaxes account found with matching upn #>
if (-not $user) {
    $Context.LogException("No user found in Adaxes by UPN $upn")
}

$Context.LogMessage("$($user.objectGUID)", "Information")

Move-AdmObject -Identity $user -TargetPath "%distinguishedName%"

Answer 1

Hello,

It looks like there was an attempt to move a Microsoft Entra account to an on-premises AD OU. Most probably, it happens because the -AdaxesService and -Server parameters are not specified when the Move-AdmObject cmdlet is executed. They are always required when you use Adaxes cmdlets to manage Microsoft Entra objects. To make things easier, you can try using the ADSI approach. For an example, have a look at the following article: https://adaxes.com/sdk/SampleScripts.MovingUserAccounts.

Comments

You are 100% correct. I was looking in the wrong spot the entire time. Thank you! Final working code was as follows:

Move-AdmObject -Identity $user -TargetPath "%distinguishedName%" -Server $domain -AdaxesService localhost