When the user object is being synced to the cloud service, you receive the following error message in the synchronization error report:
- Install the Azure Active Directory V2 PowerShell module. To do this, see https://www.powershellgallery.com/packages/AzureAD/22.214.171.124.
- Run the following commands, and press Enter after each command:
Connect-AzureADNote After you enter this command, you're prompted to enter your administrative credentials.
Set-AzureADUser -ObjectId [ExistingUPN] -UserPrincipalName [DefaultDomainUPN]Note In this command, [ExistingUPN] represents the current UPN of the user ID, and [DefaultDomainUPN] represents the UPN of the user ID that has the domain suffix changed to the default domain.
For example, a Contoso administrator might use the following command:
Set-AzureADUser -ObjectId email@example.com -UserPrincipalName firstname.lastname@example.org
Set-AzureADUser -ObjectId [DefaultDomainUPN] -UserPrincipalName [NewUPN]Note In the second command, [DefaultDomainUPN] represents the UPN of the user ID after you run the command, and [NewUPN] is the target UPN to which you are trying to migrate the user ID.
Note If you receive an error message after you run the second command, close and then reopen the Azure Active Directory V2 PowerShell module. Then, run the command again.
- On a domain controller, follow these steps:
- Add your initial domain as an UPN suffix in the on-premises AD DS user account.
- Change the user's UPN suffix from your domain to the initial domain.
- At a command prompt, run the following command to sync all domain controllers:
repadmin /syncall /a /p /e /d
- Force directory synchronization to sync the changes to Azure Active Directory (Azure AD). For more information about how to do this, see Azure AD Connect sync: Scheduler.
Note If you have an urgent change that must be synchronized immediately, you have to manually run a cycle. To do this, run the following cmdlet from PowerShell:
Start-ADSyncSyncCycle -PolicyType Delta
- Verify that the user name is changed in the cloud service.
- On the domain controller, change the UPN suffix of the user to use the other federated domain.
- Force directory synchronization to sync the changes to Azure AD. For more information about how to do this, see Azure AD Connect sync: Scheduler.
Note If you have an urgent change that must be synchronized immediately, you have to manually run a cycle. To do this, run the PowerShell cmdlet from step 2 of this procedure.
- Verify that the user name changed in the cloud service.