Office365 and UPN suffixes

[pete]

This is a "can you just check I've got this right?" post.

 

• Our current UPNs are of the format [email protected]
  
• Our internal domain is subdomain.school.region.sch.uk
  
• Our embryonic Office365 is using our school.region.sch.uk domain.
  
• Our email addresses are of the format [email protected], with aliases for [email protected]
  

 

From what I can glean from the documentation* and various blogs, I need to configure an alternate UPN suffix of school.region.sch.uk and apply that to any accounts in OUs that I'm including in DirSync.

 

 

However, If I didn't add the UPN suffix and change the UPN of any accounts I want to include in Office365 would it...

 

Give me an Office365 username of:

 

[email protected]

[email protected]

[email protected]

 

?

 

(I'm asking because we've got a couple of bits of software that are (IIRC) picky about changed UPNs.)

 

*which has gaps you could drive wildebeest through.

[plexer]

It'd be whatever you've picked.onmicrosoft.com

 

Unless you had added your current domain and validated it which you can't do unless it's internet accessible.

 

Ben

[plexer]

If you want to sync using your email domain then yes you need to configure it as an alternative upn suffix and change your uses accounts to use it.

 

Do this before you run a sync as it's a pain to change afterwards.

 

Ben

[pete]

Cheers.

 

Now I need to go audit all the stuff talking to AD to see how it handles an UPN change.

[plexer]

Most stuff probably just references the sAMAccountName so I doubt it'll make any difference.

 

Ben

[Edu-IT]

You could, I think, if you needed to, don't change your UPN but just add in alias email addresses for your school domain? I am sure there's a Powershell to do that in bulk.

[plexer]

adding it as an smtp address may indeed work but I haven't tested that.

 

Ben

[EduTech]

Hi,

 

The UPN that you choose with in essence be the User ID assigned to the user when they login to Microsoft Office 365, generally people try to keep this the same as the Primary SMTP to keep things simple for the end users so that they don't have to remember another (email type address) as we all know a lot of people struggle to remember their actual email address due to how long they are in some case! :-)

 

So, You will need to do the due-diligence to ensure none of your third party applications rely on the UPN Attribute within Active Directory but my guess is that they would use the SamAccountName to be honest.

 

You would add the UPN Suffix into Domains & Trusts, You would then assign the users across your organization with the new UPN Suffix. (this script may help with that)

 

#Replace with the old suffix

$oldSuffix = 'old.suffix'

 

#Replace with the new suffix

$newSuffix = 'new.suffix'

 

#Replace with the OU you want to change suffixes for

$ou = "DC=sample,DC=domain"

 

#Replace with the name of your AD server

$server = "domain controller"

 

Get-ADUser -SearchBase $ou -filter * | ForEach-Object {

$newUpn = $_.UserPrincipalName.Replace($oldSuffix,$newSuffix)

$_ | Set-ADUser -server $server -UserPrincipalName $newUpn

}

 

When you run the directory sync, your users then will have a User ID as above (UPN) and they will also have this as an SMTP Attribute. You can add further Proxy Addresses if you wish to these user accounts in bulk by using the following PowerShell command: {remember to create a CSV File, which uses the below headers}

 

Import-CSV C:\UserList.CSV | ForEach {$user = Get-ADUser $_.UserPrincipalName -property proxyAddresses | $user.ProxyAddresses = @{Add=$_.EmailAddresses | Set-ADuser -Istance $user}}

 

I hope that helps,

 

James.

[Cache]

I know it's not the most efficient way, but I currently manually activate the new accounts and at that point also change the UPN from the onmicrosoft.com domain to the school email domain.

 

Doing them in bulk makes this less time consuming, however means I haven't had to alter anything in AD.

[Marshall_IT]

I used wise soft bulk ad to do the prep work in ad, the only thing I wish id done and I still might, is add the exchange custom attributes, but running the start of an exchange installer seems a not so great way to do this.

 

I changed the pun suffix to match my email address, however we want a specific email address format and I didn't really fancy changing everyone's usernames to match this format.

 

So my staff have a username example [email protected]

 

And an email address [email protected]

 

My students have the same user and email which is much simpler.

 

I would really advise getting the work done in ad first, now I have a script set to run automatically which assigns licenses, set locale etc for new users just after each sync.