ad-dir-sync-stuff.ps1

#set the user to fix, this should match the duplicate that was sent from local AD
$sam = "user1"
$old = "$sam@olddomain.com"
$new = "$sam@newdomain.com"
#show the users
Get-MsolUser -UserPrincipalName $old
Get-MsolUser -UserPrincipalName $new
#remove the old user
Remove-MSOLuser -UserPrincipalName $old -Force
#remove it from recyclebin
Remove-MSOLuser -UserPrincipalName $old -RemoveFromRecycleBin -Force
#get the local ad guid
$guid = (get-Aduser $sam).ObjectGuid
##convert it to an immutableID
$immutableID = [System.Convert]::ToBase64String($guid.tobytearray())
#set the proper immutableID for the cloud AD account
Set-MSOLuser -UserPrincipalName $new -ImmutableID $immutableID
#show users again
Get-MsolUser -UserPrincipalName $old #this should fail
Get-MsolUser -UserPrincipalName $new


# Don't forget to sync AD
Start-ADSyncSyncCycle -PolicyType Delta

# If you want to see more details on the AD Sync, try get-ad below, can turn on/off with first command
Set-ADSyncScheduler -SyncCycleEnabled $true	
Start-ADSyncSyncCycle -PolicyType Delta
Get-ADSyncScheduler


# reset user password and force push to o365
Set-ADAccountPassword user1 -Reset -NewPassword (ConvertTo-SecureString -AsPlainText "plaintextpassword1" -Force )
Set-ADAccountPassword user2 -Reset -NewPassword (ConvertTo-SecureString -AsPlainText "plaintextpassword2" -Force )
Start-ADSyncSyncCycle -PolicyType Delta