Although NetIQ AA can leverage multiple LDAP identity repositories, you must ensure that Retain users only appear in one of them.
For example, if you configured NetIQ AA multi-factor authentication for GroupWise or Exchange users in Retain 4.9.2, then you defined repositories in AA for their respective LDAP services.
If you now add a repository for Retain’s User Accounts LDAP service, your GroupWise and Exchange users will have duplicate accounts. Therefore, you must remove their respective LDAP repositories from your NetIQ AA service.