UPN Suffix / Azure AD query

[jonbd]

I'm looking to get Azure AD connect up and running so we can sync users and have SSO for OneDrive/Office365, but wanted to get a couple of bits straight in my head before I dive in.

 

Our office365 domain and internal AD don't match (school.sch.uk vs school.internal) so I need to add a UPN suffix to sort this. usernames are the same though, so SCHOOL\jbloggs will be jbloggs@ school.sch.uk. Can anyone help answer the following at all?

 

1 - Just adding the UPN Suffix to AD won't affect anything will it, it will just sit there until I apply it to a user?

 

2 - If I change the UPN suffix of a user, can they still log onto a PC with the usual username and password, or would they then have to use their email address instead?

 

3 - If they can login as usual (username not email address), would that affect SSO to Office 365/Onedrive, or will it not matter?

 

Thanks

 

Jon

[Boredguy]

1 - adding a suffix rarely breaks anything

2 - With the new suffix, users still logon as normal, or they can choose to use their e-mail address

3 - Depending on how you configure your browsers for SSO, your users may be prompted to enter their e-mail address to login to 365 web services (but not their password). Logging into the workstations is not affected in any way

[chaplic]

Agree with boredguy, I've changed UPNs for tens of thousands of users and only seen an issue with one random app

 

Additional to 3) though, changing a UPN (e.g. [email protected] to [email protected]) is a right PITA to do in bulk, so make sure you start with the right one. I'd also ensure that UPN==Email address

[jonbd]

Thanks guys. My main concern was that adding the UPN would affect current users in some way while I test, but it sounds like I can add the UPN and some test users without issue.

[Boredguy]

Agree with boredguy, I've changed UPNs for tens of thousands of users and only seen an issue with one random app

 

Additional to 3) though, changing a UPN (e.g. [email protected] to [email protected]) is a right PITA to do in bulk, so make sure you start with the right one. I'd also ensure that UPN==Email address

 

To be honest, it's not that bad to update in bulk, Select a load of users in AD Users and Computers -> Right click -> properties -> Account Tab, tick UPN suffix and select the one from the drop down and click ok.

 

Now if the e-mail addresses does not follow the same naming convention as the network user name, that is a pain