GUID, ImmutableID and SID Converter

Paste an objectGUID, an ImmutableID, an S-1-5-… SID, or a raw hex or base64 blob. It works out which one you gave it and shows all the other shapes — including the escaped octet strings you need inside an LDAP filter.

Why there are so many shapes

A GUID has two byte orders. The string form 1c2d3e4f-5a6b-… is big-endian, but Guid.ToByteArray() in .NET — and therefore the bytes Active Directory stores and Entra Connect base64-encodes — reverses the first three groups. That is why an ImmutableID looks nothing like the GUID it came from, and why a naive base64 of the GUID string produces a value that matches nothing.

SIDs have the same problem in reverse: the identifier authority is big-endian, the sub-authorities are little-endian, and the whole thing is stored as a binary blob you cannot paste into a portal.

Where you actually need this

# Hybrid identity: match a cloud user back to its on-premises account
Get-MgUser -Filter "onPremisesImmutableId eq 'Tz4tHGtafUyOnwobLD1OXw=='"

# Find the AD object behind a SID from an event log or an ACL
Get-ADObject -LDAPFilter '(objectSid=\01\05\00\00\00\00\00\05\15...)'

# Repair a broken soft-match after a failed Entra Connect migration
Set-MgUser -UserId $id -OnPremisesImmutableId "Tz4tHGtafUyOnwobLD1OXw=="

Batch mode

Paste several values on separate lines and you get a conversion table instead of a detail view — handy when you are reconciling a list of orphaned objects.