Is possible to prevent the domain of the UPN to be changed to the onmicrosoft.com when syncing existing accounts?

Question

I have a scenario in which a synchronization is being performed from a local Active Directory to an existing Azure AD through AD Connect. I want to synchronize for example the user on cloud example@domain.com with the user example@domain.local that is on-premises.

Per Microsoft's official documentation regarding AD Connect states: "If the value of the userPrincipalName attribute doesn't correspond to a verified domain in Azure AD, the synchronization process replaces the suffix with a default .onmicrosoft.com value."

https://learn.microsoft.com/en-us/azure/active-directory/hybrid/howto-troubleshoot-upn-changes

This causes the UPN of the user example@domain.com be renamed to example@domain.onmicrosoft.com and as the Shadow UPN will have example@domain.local. This happens even if I have domain.com as the primary domain. I want to prevent this to happen since it will affect the login of the users.

So I wanted to know if there is a way to work around this limitation and prevent the change of the UPN or it will be necesary to rename the UPN of the user through PowerShell.

Thanks in advance.

Answer 1

If the domain is not owned by you, UPN of the user example@domain.com will be renamed to example@domain.onmicrosoft.com and the Shadow UPN will have example@domain.local

If the Domain is owned by you, you can add the domain in Azure Active Directory and verify it. Once its verified, you can use the same UPN for both local AD and Azure AD.

Go to your Azure Active Directory --> Under Manage, click on Custom Domain Names --> Click on Add Custom Domain --> Enter your Custom Domain Name --> Click on Add Domain

Go to your Domain Manager --> Add either TXT or MX record in your Domain Manager as shown in the Azure Active Directory.

Once Record is added in your Domain Manager, click on Verify.

Once the Domain is verified, while syncing the Windows Active Directory with Azure Active Directory, you can see your custom domain which is verified as UPN suffix.