Which password a merged user keeps
On the Compare step of Merge users, the Password row decides which account's password the merged user signs in with. Passwords are a choice like any other field, but the values are never shown.
What the Password row shows
Instead of the password itself, each account's Password cell says one of:
| Label | What it means |
|---|---|
| School default | The account is still on the default password for its role, as set in School settings → Password |
| Custom password | The password has been changed since — to one you'd have to ask the user for |
| School default · same as primary, or Custom password · same as primary | Both accounts already have the same password, so this choice changes nothing |
| Not set | The account has no password stored |
Choosing a password
The primary's password is selected by default, so leaving this row alone keeps things exactly as they are today. If you choose a secondary's password instead, the merged user signs in with that password from the moment the merge completes — their previous one stops working.
Choose the secondary's password when the duplicate is the account the person actually uses and knows the password for — merging onto a primary they've never signed into would otherwise lock them out until you reset it.
When it reaches Google, Entra and Active Directory
Where it goes next is the same as for any other password change, and depends on what each platform is set to do:
| Platform | When the new password reaches it |
|---|---|
| Google Workspace | On the next sync, if Sync passwords to Google is on for the school and the person's role isn't ticked under Skip password sync for these user types |
| Microsoft Entra | On the next sync, if Sync passwords to Entra is on in your Entra settings and the person's role isn't ticked under Skip password sync for these user types |
| On-premise Active Directory | Queued for the connector's next run, if Sync passwords to AD is on |
If a platform doesn't sync passwords, the person keeps whatever password they already had there — merging doesn't change it.
One limitation, and only for a small number of schools whose default password was set up before ADAdmin stored a re-readable copy of it: where the chosen password is one of those defaults, only its one-way hash exists. The merged user still signs in with it in the app, and Google Workspace still receives it (Google is sent the stored hash, not the plaintext). Microsoft Entra and on-premise Active Directory both need the plaintext, so for those two the password stays as it was until the school re-saves its default under School settings → Password. The notifications bell asks for that re-save when it applies to you.
Troubleshooting
- "The user can't sign in after the merge" — check which password the merge kept. On the compare step the Password row defaults to the primary, so if the person only ever knew the password for the duplicate account, that's the one to choose. If the merge has already run, just reset their password as normal.
Related
Was this guide helpful?
We read every response — it decides what we rewrite next.
Thanks for your feedback.