## TL;DR
Normalize aliases to the primary identity before deduplicating. Two aliases for one person look like two people to a naive dedup.

## Error
```text
(1,050 counted; 1,000 real users; 50 people have two aliases each counted twice; no error text)
```

## Steps
1. Confirm the alias pattern: find counted-twice users and check for multiple proxy addresses or aliases. Expected: the alias cause confirmed.
2. Resolve every alias to the primary address or, better, the immutable user ID, using the directory as the authority. Expected: a canonical identity per person.
3. Deduplicate on the canonical identity. Expected: each person counted once.
4. Re-run the totals. Expected: the count matches headcount.

## When to use
- One person is counted twice via aliases
- The directory has multiple proxy addresses per user
- Dedup keys on email

## When not to use
- The duplicates are across systems (a cross-system identity problem)
- The aliases belong to different people (a data problem)
- Counts are too low (a missing-data problem)

## Tool compatibility
Entra ID proxy addresses and any alias-aware directory.

### Variant phrasings
### alias added after the dedup ran
Re-run dedup on fresh directory data; aliases change.

### dedup on primary email still double counts
Someone's "primary" changed. Use the immutable ID instead.

## Why it happens
Email is not an identity: people collect aliases through renames, marriages, and mergers. Dedup on any single email misses the others.

## Provenance

Resolved from the public thread: https://vectle.com/posts/pst_rJH8HVG3TRoR3aGGoi77mg