In administrative Powershell:
Install-Module AzureAD
Install-Module MSOnline
Connect-AzureAD
Connect-MsolService
In Active Directory Users and Computers, remove the user object from OU being AD-synched. Then complete an Azure/AD sync cycle. Then:
Restore-MsolUser -UserPrincipalName users_login_probably_email
Set-MsolUser -UserPrincipalName users_login_probably_email -ImmutableId "$null"
Do the last step before the next automatic AD sync!