You update the user principal name (UPN) of an on-premises Active Directory Domain Services (AD DS) user account to use a different single sign-on (SSO)-enabled domain suffix. However, directory synchronization doesn't propagate the change from one federated domain directly to another federated domain for a user ID in Microsoft Office 365.
When the user object is being synced to Microsoft cloud services, you receive the following error message in the synchronization error report:
Unable to update this object in Microsoft Online Services, because the attribute FederatedUser.UserPrincipalName is not valid. Update the value in your local Active Directory
This problem occurs because you can't use Office 365 tools in a single step to change the UPN suffix of a user ID from one SSO-enabled domain suffix to another SSO-enabled domain suffix.
To work around this problem, use one of the following methods.
On a client computer that has the Windows Azure Active Directory Module for Windows PowerShell installed, follow these steps:
- Click Start, point to All Programs, click Windows Azure Active Directory, right-click Windows Azure Active Directory Module for Windows PowerShell, and then click Run as administrator.
- Run the following commands, and press Enter after each command:
- Note When you're prompted, enter non-federated Office 365 global administrator credentials.
Note In this command, [ExistingUPN] represents the current UPN of the user ID, and [DefaultDomainUPN] represents the UPN of the user ID that has the domain suffix changed to the default domain.
Set-MsolUserPrincipalName -UserPrincipalName [ExistingUPN] -NewUserPrincipalName [DefaultDomainUPN]
For example, a Contoso administrator might use the following command:
Set-MsolUserPrincipalName -UserPrincipalName email@example.com -NewUserPrincipalName firstname.lastname@example.org
- Exit the Windows Azure Active Directory Module for Windows PowerShell.
- Open the Windows Azure Active Directory Module for Windows PowerShell again. Then, run the following commands, and press Enter after each command:
Note In this command, [DefaultDomainUPN] represents the UPN of the user ID after you run the command in step 2b, and [NewUPN] is the target UPN to which you are trying to migrate the user ID.
Set-MsolUserPrincipalName -UserPrincipalName [DefaultDomainUPN] -NewUserPrincipalName [NewUPN]
- On a domain controller, follow these steps:
- Add your initial domain as an UPN suffix in the on-premises AD DS user account.
- Change the user's UPN suffix from your domain to the initial domain.
- At the command prompt, run the following command to sync all domain controllers:
repadmin /syncall /a /p /e /d
- Force directory synchronization to sync the changes to Windows Azure Actvie Directory (Windows Azure AD). For more info about how to do this, see Force directory synchronization
- Confirm that the user name is changed in Office 365.
- On the domain controller, change the UPN suffix of the user to use the other federated domain.
- Force directory synchronization to sync the changes to Windows Azure AD. For more info about how do do this, see Force directory synchronization
- Verify that the user name changed in Office 365.
For more information, go to the following Microsoft Knowledge Base articles:
Troubleshoot user name issues that occur for federated users when they sign in to Office 365, Windows Azure, or Windows Intune
User name of users in your organizational account such as Office 365, Windows Azure, or Windows Intune don't match the on-premises UPN
Still need help? Go to the Office 365 Community
website or the Windows Azure Active Directory Forums
Article ID: 2669550 - Last Review: October 31, 2013 - Revision: 21.0
- Windows Azure
- Microsoft Office 365
- Microsoft Office 365 for enterprises (pre-upgrade)
- Microsoft Office 365 for education (pre-upgrade)
- CRM Online via Office 365 E Plans
- Windows Azure Recovery Services
|o365 o365a o365022013 after upgrade o365062011 pre-upgrade o365e o365m KB2669550|