Hi Eyal,
Thank you so much for sharing about the miisclient! After clicking on the error link, a window titled Connector Space Object Properties opens. I matched the Distinguished Name in the window with the On-Premises Object ID that is sent in the error email.
However, I do not see a "validate object against schema". I see Preview only. Must be a version difference.
But your advice has been extremely helpful because I now know my issue is AD related--and I know about miisclient.exe too. Looks like we have the mail attribute set to a cloud account with the userPrincipalName as onpremise.
Thank you Eyal, and everyone else that assisted. Eyal, good luck with your issue.
Appreciatively,
--Liko