Office 365 Username Change syncing..

[victory2012]

is anyone knowledgeable about 365 and syncing with AD.. We have adfs and azure sync all setup everything is working great, however we want to change everyones username (samaccountname) to another format.

 

Issue is when i change my test users username from jsmith to jsm he can no longer login to 365, we get an error when signing in

"The SAML 1.1 Assertion contains no ImmutableID of the user."

 

only way to get it working again is to change the username back again.

 

If anyone has any ideas would be great i need get these usernames changed asap.

 

Many Thanks

[sted]

iirc by default azure ad sync uses samaccount name as the link between accounts so you can't change it and iirc the only way to change that it to completely remove azure ad sync and reinstall it with a different key field (say email)

[victory2012]

iirc by default azure ad sync uses samaccount name as the link between accounts so you can't change it and iirc the only way to change that it to completely remove azure ad sync and reinstall it with a different key field (say email)

 

thanks for reply, surely that cant be right, what if the person needs it changes because they have got married? thanks though i will look into it

[Steve21]

Did you change their login name via powershell on the 365 side? It won't change by default once set it needs to be manually done.

 

Steve

[Boredguy]

I use Set-MsolUserPrincipalName -UserPrincipalName [email protected] -NewUserPrincipalName [email protected] and make sure that the user has a e-mail alias of their old account name for a few months as well.

[victory2012]

Hi, thanks yes issue being im not changing the UserPrincipalName so they are the same i am changing the SamAccountName soon as i do that and syning occurs i cannot login to 365

[Steve21]

Why would you be changing one and not the other? If the purpose is to change their username and email you'll want the UPN too.

 

Steve

[victory2012]

Why would you be changing one and not the other? If the purpose is to change their username and email you'll want the UPN too.

 

Steve

 

UPN is correctly set

 

we want them to login in school using their 3 letter codes.. so Management want the usernames changed to three letters.

 

e.g UPN is john.smith at present

samaccount name is jsmith but will be changed to jsm.

 

i just dont understand why i cant login to 365... i thinking theres issue with adfs but no ideas and nothing seems be on google about this issue directly other than brief mention about surname changes when someone gets married

Edited July 24, 2018 by victory2012

[Steve21]

So what are you using as their login name (not email) in 365 currently? jsmith?

 

Steve

[victory2012]

So what are you using as their login name (not email) in 365 currently? jsmith?

 

Steve

 

it would be their upn [email protected] however adfs auto signs in using domain\samaccountname .. so i thinking adfs issue?

[chaplic]

There is a a *cough* feature in AzureAD sync which means it cannot handle UPN changes. So say I was [email protected] and I change the on premise upn to [email protected], Azure AD sync will break

 

There's two ways to tackle this

 

1) Add your cloud tennant as a UPN on your local AD (e.g. mytennant.onmicrosoft.com). When you want to change UPN, first change it to that (so [email protected], [email protected], [email protected]) having a sync cycle every time

 

2) Do the on premise change, wait for it to fail, then in cloud, change to tennant upn, change to desired UPN. The powershell function below achieves this (of course you will test it first)

 

Be aware, onedrive will break, smartphone apps will break, skype will break and outlook appears OK but online meetings will fail. This is just a case of reconfiguring the client.

 

ChangeUPN.txt

[victory2012]

There is a a *cough* feature in AzureAD sync which means it cannot handle UPN changes. So say I was [email protected] and I change the on premise upn to [email protected], Azure AD sync will break

 

There's two ways to tackle this

 

1) Add your cloud tennant as a UPN on your local AD (e.g. mytennant.onmicrosoft.com). When you want to change UPN, first change it to that (so [email protected], [email protected], [email protected]) having a sync cycle every time

 

2) Do the on premise change, wait for it to fail, then in cloud, change to tennant upn, change to desired UPN. The powershell function below achieves this (of course you will test it first)

 

Be aware, onedrive will break, smartphone apps will break, skype will break and outlook appears OK but online meetings will fail. This is just a case of reconfiguring the client.

 

[ATTACH]49786[/ATTACH]

 

Many thanks for your reply and solution, however this is not my problem my UPN's are correct , i am not changing the UPN's i am changing the samaccountname (username) of the user and for some reason this breaks login to 365 via adfs.. still have no idea why..

[chaplic]

100% Sure?

 

OK, what are you using as immutableID. Out of the box, this is a GUID, but it's possible to change it to anything you want (say employeeID) or SamAccountName

 

I don't think this is an ADFS issues, ADFS is giving o365 the thumbs up that the account is authenticated OK but o365 is saying 'cannot find that account';

Edited July 25, 2018 by chaplic

[victory2012]

100% Sure?

 

OK, what are you using as immutableID. Out of the box, this is a GUID, but it's possible to change it to anything you want (say employeeID) or SamAccountName

 

I don't think this is an ADFS issues, ADFS is giving o365 the thumbs up that the account is authenticated OK but o365 is saying 'cannot find that account';

 

See below, i believe this is pretty standard... this is why i am confused i have no idea why its giving me the error

 

c:[Type == "http://schemas.microsoft.com/ws/2008/06/identity/claims/windowsaccountname"]

=> issue(store = "Active Directory", types = ("http://schemas.xmlsoap.org/claims/UPN", "http://schemas.microsoft.com/LiveID/Federation/2008/05/ImmutableID"), query = "samAccountName={0};userPrincipalName,objectGUID;{1}", param = regexreplace(c.Value, "(?[^\\]+)\\(?.+)", "${user}"), param = c.Value);

[chaplic]

Yep, you are using samaccountname as immutableID. AzureAD sync definitely won't deal with a change of that. Here's how to fix

 

1) The account in the cloud is probably soft deleted already, if not, soft delete it

2) Restore the soft deleted account to a cloud account

3) change the immutableID to the new samaccountname

4) change UPN to the on premise one.

 

5) Wait for sync

Edited July 25, 2018 by chaplic

[victory2012]

Yep, you are using samaccountname as immutableID. AzureAD sync definitely won't deal with a change of that. Here's how to fix

 

1) The account in the cloud is probably soft deleted already, if not, soft delete it

How do i soft delete?

2) Restore the soft deleted account to a cloud account

How do i do that sorry?

3) change the immutableID to the new samaccountname

So change the id to jsm?

4) change UPN to the on premise one.

 

5) Wait for sync

 

 

Thanks

[chaplic]

This article covers it. It is NOT a trivial activity so test and take care (clue is in the name immutable ;-). In essence anything synced from on premise you cannot change in the cloud, so what this does is break the link to on premise, makes the changes, then glues it all together again. Usernames are a very cosmetic thing, is this a necessary change and it's probably best to encourage people to use UPN

 

https://msexperttalk.com/understand-and-modify-office365-users-immutableid/