Changes aren't synced by the Azure Active Directory Sync tool after you change the UPN of a user account to use a different federated domain
You update the user principal name (UPN) of an on-premises Active Directory Domain Services (AD DS) user account to use a different federated domain. However, directory synchronization doesn't propagate the change from one federated domain directly to another federated domain for a user ID in a Microsoft cloud service such as Office 365, Microsoft Azure, or Microsoft Intune.
When the user object is being synced to the cloud service, you receive the following error message in the synchronization error report:
Unable to update this object in Microsoft Online Services, because the attribute FederatedUser.UserPrincipalName is not valid. Update the value in your local Active Directory
This problem occurs because the service doesn't allow you to change the federated domain suffix of a user to a different federated domain suffix.
To work around this problem, use one of the following methods.
Method 1On a client computer that has the Azure Active Directory Module for Windows PowerShell installed, follow these steps:
- Click Start, point to All Programs, click Windows Azure Active Directory, right-click Windows Azure Active Directory Module for Windows PowerShell, and then click Run as administrator.
- Run the following commands, pressing Enter after each command:
connect-MSOLServiceNote When you're prompted, enter non-federated cloud service global administrator credentials.
Set-MsolUserPrincipalName -UserPrincipalName [ExistingUPN] -NewUserPrincipalName [DefaultDomainUPN]Note In this command, [ExistingUPN] represents the current UPN of the user ID, and [DefaultDomainUPN] represents the UPN of the user ID that has the domain suffix changed to the default domain.
For example, a Contoso administrator might use the following command:
Set-MsolUserPrincipalName -UserPrincipalName firstname.lastname@example.org -NewUserPrincipalName email@example.com
Set-MsolUserPrincipalName -UserPrincipalName [DefaultDomainUPN] -NewUserPrincipalName [NewUPN]Note In this command, [DefaultDomainUPN] represents the UPN of the user ID after you run the command in step 2B, and [NewUPN] is the target UPN to which you are trying to migrate the user ID.
Note If you get an error when you perform step 2C, close and then reopen the Azure Active Directory Module for Windows PowerShell. Then, run the command again.
- On a domain controller, follow these steps:
- Add your initial domain as an UPN suffix in the on-premises AD DS user account.
- Change the user's UPN suffix from your domain to the initial domain.
- At the command prompt, run the following command to sync all domain controllers:
repadmin /syncall /a /p /e /d
- Force directory synchronization to sync the changes to Azure Active Directory (Azure AD). For more info about how to do this, see Force directory synchronization.
- Confirm that the user name is changed in the cloud service.
- On the domain controller, change the UPN suffix of the user to use the other federated domain.
- Force directory synchronization to sync the changes to Azure AD. For more info about how to do this, see Force directory synchronization.
- Verify that the user name changed in the cloud service.
For more information, go to the following Microsoft Knowledge Base articles:
2392130 Troubleshoot user name issues that occur for federated users when they sign in to Office 365, Azure, or Intune
2523192 User names in Office 365, Azure, or Intune don't match the on-premises UPN or alternate login ID
Still need help? Go to the Office 365 Community website or the Azure Active Directory Forums website.
Article ID: 2669550 - Last Review: 12/12/2014 09:47:00 - Revision: 30.0
Microsoft Azure cloud services, Microsoft Azure Active Directory, Microsoft Office 365, Microsoft Intune, CRM Online via Office 365 E Plans, Microsoft Azure Recovery Services, Office 365 Identity Management
- o365 o365a o365022013 o365e o365m KB2669550