Changes aren't synced by the Azure Active Directory Sync tool after you change the UPN of a user account to use a different federated domain

Article translations Article translations
Article ID: 2669550 - View products that this article applies to.
Expand all | Collapse all

PROBLEM

You update the user principal name (UPN) of an on-premises Active Directory Domain Services (AD DS) user account to use a different federated domain. However, directory synchronization doesn't propagate the change from one federated domain directly to another federated domain for a user ID in a Microsoft cloud service such as Office 365, Microsoft Azure, or Windows Intune.

When the user object is being synced to the cloud service, you receive the following error message in the synchronization error report:
Unable to update this object in Microsoft Online Services, because the attribute FederatedUser.UserPrincipalName is not valid. Update the value in your local Active Directory

CAUSE

This problem occurs because the service doesn't allow you to change the federated domain suffix of a user to a different federated domain suffix.

WORKAROUND

To work around this problem, use one of the following methods.

Method 1

On a client computer that has the Azure Active Directory Module for Windows PowerShell installed, follow these steps:
  1. Click Start, point to All Programs, click Windows Azure Active Directory, right-click Windows Azure Active Directory Module for Windows PowerShell, and then click Run as administrator.
  2. Run the following commands, pressing Enter after each command:
    1. connect-MSOLService
      Note When you're prompted, enter non-federated cloud service global administrator credentials.
    2. Set-MsolUserPrincipalName -UserPrincipalName [ExistingUPN] -NewUserPrincipalName [DefaultDomainUPN]
      Note In this command, [ExistingUPN] represents the current UPN of the user ID, and [DefaultDomainUPN] represents the UPN of the user ID that has the domain suffix changed to the default domain.

      For example, a Contoso administrator might use the following command:
      Set-MsolUserPrincipalName -UserPrincipalName user1@constoso.com -NewUserPrincipalName user1@contoso.onmicrosoft.com
  3. Exit the Azure Active Directory Module for Windows PowerShell.
  4. Open the Azure Active Directory Module for Windows PowerShell again. Then, run the following commands, pressing Enter after each command:
    1. connect-MSOLService
    2. Set-MsolUserPrincipalName -UserPrincipalName [DefaultDomainUPN] -NewUserPrincipalName [NewUPN]
      Note In this command, [DefaultDomainUPN] represents the UPN of the user ID after you run the command in step 2b, and [NewUPN] is the target UPN to which you are trying to migrate the user ID.

Method 2

  1. On a domain controller, follow these steps:
    1. Add your initial domain as an UPN suffix in the on-premises AD DS user account.
    2. Change the user's UPN suffix from your domain to the initial domain.
    3. At the command prompt, run the following command to sync all domain controllers:
      repadmin /syncall /a /p /e /d
  2. Force directory synchronization to sync the changes to Azure Active Directory (Azure AD). For more info about how to do this, see Force directory synchronization.
  3. Confirm that the user name is changed in the cloud service.
  4. On the domain controller, change the UPN suffix of the user to use the other federated domain.
  5. Force directory synchronization to sync the changes to Azure AD. For more info about how to do this, see Force directory synchronization.
  6. Verify that the user name changed in the cloud service.

MORE INFORMATION

For more information, go to the following Microsoft Knowledge Base articles:
2392130 Troubleshoot user name issues that occur for federated users when they sign in to Office 365, Azure, or Windows Intune  
2523192 User names in Office 365, Azure, or Windows Intune don't match the on-premises UPN or alternate login ID
Still need help? Go to the Office 365 Community website or the Azure Active Directory Forums website.

Properties

Article ID: 2669550 - Last Review: July 9, 2014 - Revision: 26.0
Applies to
  • Microsoft Azure
  • Microsoft Office 365
  • Windows Intune
  • CRM Online via Office 365 E Plans
  • Microsoft Azure Recovery Services
  • Office 365 Identity Management
Keywords: 
o365 o365a o365022013 o365e o365m KB2669550

Give Feedback

 

Contact us for more help

Contact us for more help
Connect with Answer Desk for expert help.
Get more support from smallbusiness.support.microsoft.com