CODEWITHSUNDEEP
azure-active-directoryactive-directoryfederatedo365-flow
Vimal M
Vimal M

Reputation: 13

Different UPN suffix for a user other than federated domain and try to sync that user

What will happen if you give different UPN suffix for a user other than federated domain and try to sync that user in Azure AD.

Upvotes: 0

Views: 645

Answers (1)

Harpreet Singh Matharoo
Harpreet Singh Matharoo

Reputation: 205

I would like to confirm that end user's sign-in experience might be different considering configuration you have for AD Connect.

Let's take following configuration as an example and share 2 possible scenarios with you:

You have 3 domains on local AD out of which 2 are verified on Azure AD.

  1. domain.local - Non-Routable local domain.
  2. abc.com Sync'd - Federated with AzureAD.
  3. xyz.com Sync'd - Managed and verified on AzureAD.

Scenario 1: Optional Features like PHS is not Enabled.

  • Lets say if you sync [email protected] from on-prem to Azure AD. User would be created on Azure AD with UPN [email protected], however user would not be able to login to any Office Service or Azure AD Application with error Incorrect Username or Password.
  • Lets say if you sync [email protected] from on-prem to Azure AD. User would be created on Azure AD UPN [email protected], however user would not be able to login to any Office Service or Azure AD Application with error Incorrect Username or Password.

Scenario 2: Optional Features like PHS is not Enabled.

  • Lets say if you sync [email protected] from on-prem to Azure AD. User would be created on Azure AD with UPN [email protected], User would be able to login with on-prem username and password on any Office 365 service or Azure AD Application
  • Lets say if you sync [email protected] from on-prem to Azure AD. User would be created on Azure AD UPN [email protected], User would be able to login with on-prem username and password on any Office 365 service or Azure AD Application.

The only difference in scenario 1 and 2 is usage of Password Hash Sync feature. If password hash sync is enabled, On-Prem user's password hash is sync'd to Azure AD and hence user would be able to Sign-In to Office Service or any Azure AD Application.

Upvotes: 0

Related Questions