Duplicate accounts and merging
This article answers common questions about duplicate personnel records, email conflicts, and how merging works in Secureframe. For step-by-step merge instructions see Editing & Merging Personnel Records, or the Master Index: Personnel Management.
What should I do with duplicate user accounts that have different email addresses?
Select both records on the Personnel page, click Merge, and choose the email you want to keep as the primary profile. Compliance records such as training, policy acceptances, and task history from both records are combined.
Common causes are domain changes, personal vs work emails, or the same person syncing from more than one integration. See Editing & Merging Personnel Records for the full workflow.
Why do I get "email already taken" when updating a user's email, but I cannot find another record with that address?
The email is usually already tied to a different personnel record, often on the Inactive, Non-Personnel, or Auditors tab rather than the main Active list.
Search Personnel by the exact email address, check all tabs, and merge the records instead of editing the email in place. If you still cannot find the conflicting record, contact [email protected].
Why can't I merge two personnel records even when they look like the same person?
Both records must be visible and selectable on the Personnel page. If only one appears in the merge picker, the other may be on a different tab, filtered out, or tied to a different personnel type.
Clear filters, search by each email, and confirm both records are categorized as employee or contractor. Service accounts should be marked Non-Personnel rather than merged with real users. See Understanding personnel statuses & scoping.
Two records have the same email but came from different integrations. How do I merge them?
Select both records and merge them, choosing the email you want to keep. After the merge, run a manual sync on the connected integrations so linked accounts consolidate under the primary profile.
If the merge option does not appear even though the records look identical, contact Support with both personnel names and emails.
Can I undo a merge or unmerge two users?
Merges cannot be undone in the product. If the wrong profiles were merged, email [email protected] with both original email addresses and which profile should be restored.
Is there a bulk way to find or merge duplicate users?
Not today. Duplicates are resolved by searching Personnel, selecting records, and merging manually. For large cleanups, contact Support for assistance.
Login and sign-in errors
Why do I see "Account not found" when signing in with Microsoft or Google?
Secureframe could not match the identity provider sign-in to an active personnel record. Common causes include the user is Uncategorized or Not Invited, the directory integration is disconnected, or the Microsoft or Google account is linked to a different profile such as a duplicate or non-personnel record.
Confirm the user exists on Personnel with the same email, is categorized and invited, and that your Office 365 or Google Workspace integration is connected and synced. See Understanding Domain Claims, SSO, and OAuth and Microsoft Office 365 (O365).
A user cannot log in with a magic link or password reset email. What should I check?
Confirm they are signing in with the exact email on their Personnel profile, not an alias or old address.
Check spam and quarantine folders. Magic links expire after 15 minutes and password reset links after 6 hours.
Confirm the user is Active, Invited, and categorized on Personnel. Resend the invite or use Trouble signing in on the login page. See Having trouble logging into Secureframe.
Which email address should the user sign in with?
Use the primary email shown on the user's Personnel profile after any merge. If the user has both a work and personal email in Secureframe, merge the records and keep the address they will use to sign in going forward.
An employee invite bounced or the email was inactive when first invited. How do I fix it?
Update the email in your HRIS or directory source if needed, sync the integration, confirm the correct address on Personnel, then re-invite the user.
If the original invite hard bounced, the user can still sign in after the email is corrected by using Trouble signing in on the login page.
Email and domain changes
We are migrating to a new email domain. How do we avoid losing users or creating duplicates?
When a user gets a new address, merge their old and new personnel records and select the new email as primary rather than creating a second profile.
Connect and sync the new domain through your directory integration, then review Personnel for duplicates before audit season. See Editing & Merging Personnel Records.
Can I bulk update email addresses for multiple users?
Personnel CSV import can add or update records, but email changes that conflict with an existing profile still require a merge. There is no bulk email swap in the product today.
Non-personnel and service accounts
How do I mark accounts as Non-Personnel without a real email address?
Use the three-dot menu on the Personnel record and select Mark as non-personnel. Non-Personnel is intended for service accounts, aliases, and shared mailboxes that are not real employees or contractors.
You can reuse a placeholder email for multiple non-personnel accounts when they do not need distinct identities. See Understanding personnel statuses & scoping.
Do I need a unique email for every service account?
No. Mark service accounts as Non-Personnel and use a shared placeholder email when appropriate. If an integration keeps recreating connector accounts, mark them Non-Personnel rather than deleting them after each sync.
Super Admin and access roles
After merging to a new email, how do I confirm Super Admin access on the merged profile?
Open the merged user's Personnel profile and check the Access Role column or profile detail. Only Super Admin users can grant or change admin roles.
If the role did not carry over as expected, a remaining Super Admin can reassign it from the profile Edit menu. See How to add an Admin or Super Admin.
How do I see who has Super Admin access in my organization?
On the Personnel page, add or enable the Access Role column and filter or sort for Super Admin. If you no longer have any Super Admin at your organization, contact [email protected].
Microsoft Entra and Office 365
How do I fix a 401 Unauthorized error when reconnecting Microsoft Entra?
A 401 usually means the Entra connection token expired or the admin who originally connected no longer has sufficient permissions.
Reconnect using a Microsoft Entra admin account with the permissions required for your connection type. If using your own app registration, confirm the Client ID, secret, and Tenant ID are current. After reconnecting, run a manual sync from the Integrations page.
See Microsoft Entra ID for setup details. If reconnect still fails, contact [email protected] with the sync error screenshot.
Why aren't guest or unlicensed Office 365 accounts syncing into Personnel?
Guest and unlicensed users are excluded by default unless you enable those options during Office 365 setup or in the integration settings.
Review the connection settings, include guest or unlicensed accounts if they should be in scope, reconnect if needed, and run a manual sync. See Microsoft Office 365 (O365).
We are moving from Office 365 sync to SCIM. How do we avoid duplicate users?
Secureframe matches users on name and email when possible, but overlapping directory and HR integrations can still create duplicates during a transition.
Validate SCIM data before removing the old source, merge duplicates as they appear, and avoid running multiple sources of truth without a merge plan. See FAQs: Single sign-on and SCIM Provisioning.