Why an identity needs a decision
- The source address changed during the migration.
- The recipient is a guest and is not yet present in the destination.
- Two people or groups share a display name, or an email address is absent.
- The source identity was deleted or intentionally omitted from migration.
- The source is a group but the proposed destination is an incompatible account type.
Resolve the affected identity
- Check the source type, email, and source key rather than relying only on the displayed name.
- Search the destination tenant and inspect the returned account type and email/UPN.
- If the correct internal account or group is missing, ask the destination administrator to provision it. For eligible guests, consider the same-external-email option.
- Exclude identities that should no longer have access, then save the decisions and prepare again.
- Review the updated counts. If there are no ready changes, inspect the remaining blocked and review reasons rather than trying to bypass approval.
If it still appears blocked
Confirm you are viewing the latest preparation and the intended tenant pair. Saving a standalone identity mapping does not automatically rebuild an already-created restore plan.
If the destination object was removed or the connected tenant changed, a previously valid selection may no longer be usable. Search and verify the recipient again. Send support the exact source key and run reference if the decision cannot be saved.