O365 Setup - AD UPN Differs from E-mail domain

[Stuart_C]

Hi there,

 

I'm setting up O365 for our school but have a bit of a concern. We want to use AD sync however our Windows AD domain is our old domain name that we have publicly made defunct (I just haven't renamed the AD domain as that's not fun). When we have pupils log in I want to use our new domain. Is there a way round this?

Basically as far as windows locally is concerned users are "username@OldDomain" but for E-mail it's "username@NewDomain" and it's username@NewDomain I need for O365.

 

I have validated our new domain so that's all sorted.

[sonofsanta]

A user's UPN doesn't need to match your internal domain - before O365, our users were all [email protected]al. I changed 'em all to [email protected] to meet the O365 requirements and nothing broke. Smoothwall still sees them as the old UPN in Kerberos auth, strangely, but it still works so I'm not bothered

 

Basically, follow this HOW TO: Add UPN Suffixes to a Forest and then update your users - which you can do en masse in the GUI, don't even need to faff with PowerShell if you don't want to.

[Marshall_IT]

I followed the same guide as above.

 

All worked fine for me too.

[Soulfish]

You've got a few options. You could always change the AD UPN suffix if it's not used by anything else internally using something like Mass-Change UPN Suffix - Script Center - Spiceworks

 

Alternatively you could add an additional UPN suffix - DirSync/AADSync will only sync a verified/routable domains UPN suffix, so non-verified suffix's won't be synced (see Prepare for directory synchronization and https://premnair.wordpress.com/2012/03/18/add-upn-suffixes-to-active-directory-users/)

 

Finally you could also use the Alternative ID functionality that's just been added to DirSync/AADSync to change the login ID attribute to something other than the users UPN. See Configuring Alternate Login ID

[Cache]

What we do at the moment is everything is left internally as school.local and uploads using DIRsycn. Then when I activate the users in Office 365 I just adjust the upn up there to @school.county.sch.uk and in the last year have never had an issue apart from 1 user which I missed adjusting (touch wood)

[Marshall_IT]

What we do at the moment is everything is left internally as school.local and uploads using DIRsycn. Then when I activate the users in Office 365 I just adjust the upn up there to @school.county.sch.uk and in the last year have never had an issue apart from 1 user which I missed adjusting (touch wood)

 

You've got a few options. You could always change the AD UPN suffix if it's not used by anything else internally using something like Mass-Change UPN Suffix - Script Center - Spiceworks

 

Alternatively you could add an additional UPN suffix - DirSync/AADSync will only sync a verified/routable domains UPN suffix, so non-verified suffix's won't be synced (see Prepare for directory synchronization and https://premnair.wordpress.com/2012/03/18/add-upn-suffixes-to-active-directory-users/)

 

Finally you could also use the Alternative ID functionality that's just been added to DirSync/AADSync to change the login ID attribute to something other than the users UPN. See Configuring Alternate Login ID

 

I always try to automate as much as possible. It reduces the time spent on such tasks and also reduces accounts slipping through the net. Maybe it's because I'm not the most organised of people. But i just prefer it that way.