Our on-premise AD is a multi-domain forest with different business units in separate child domains. Each child domain uses a UPN of the form username[at]unitX.onpremad.com and we’ve validated all these in the cloud. However, all users have email addresses like fullname[at]emaildomain.com, that domain is also validated with Entra AD. Users frequently join teams in a different business unit so their AD account is migrated across domains and their UPN changes at that time, but their email address stays the same.

I’ve read through a lot of documentation on how the best practice is for the UPN and email to be the same for O365, but that you could have them be different using alternate ID support. But when they are different, apparently there are a number of little “gotchas” in terms of application support. So, before we sync our on-prem AD, I’m trying to understand which scenario will be the best supported over the long term with the least headaches to both users and IT.

Changing the on-prem UPN to match the email address isn’t possible due to a critical LOB app that expects the UPN suffix to break down into username and business unit domain name. So, would it best to:

Sync users with their on-prem UPN as their cloud UPN. This seems easiest to configure, but the documentation seems to imply there’s a lot of manual fixing up when the UPN changes and possibly application compatibility issues since the UPN and email are different.Sync the primary email address as the cloud UPN. Looks to require custom configuration. Has the advantage that UPN and email match and the email address rarely changes. However, I’m unclear if this is supported since we’d still have some accounts (primarily administrators) without a mailbox and so no mail or proxyAddresses fields filed in. Unclear if there are any other “gotchas” to watch out for since this is a non-standard configuration.

Thanks for any advice you can provide.

​Our on-premise AD is a multi-domain forest with different business units in separate child domains. Each child domain uses a UPN of the form username[at]unitX.onpremad.com and we’ve validated all these in the cloud. However, all users have email addresses like fullname[at]emaildomain.com, that domain is also validated with Entra AD. Users frequently join teams in a different business unit so their AD account is migrated across domains and their UPN changes at that time, but their email address stays the same. I’ve read through a lot of documentation on how the best practice is for the UPN and email to be the same for O365, but that you could have them be different using alternate ID support. But when they are different, apparently there are a number of little “gotchas” in terms of application support. So, before we sync our on-prem AD, I’m trying to understand which scenario will be the best supported over the long term with the least headaches to both users and IT. Changing the on-prem UPN to match the email address isn’t possible due to a critical LOB app that expects the UPN suffix to break down into username and business unit domain name. So, would it best to:Sync users with their on-prem UPN as their cloud UPN. This seems easiest to configure, but the documentation seems to imply there’s a lot of manual fixing up when the UPN changes and possibly application compatibility issues since the UPN and email are different.Sync the primary email address as the cloud UPN. Looks to require custom configuration. Has the advantage that UPN and email match and the email address rarely changes. However, I’m unclear if this is supported since we’d still have some accounts (primarily administrators) without a mailbox and so no mail or proxyAddresses fields filed in. Unclear if there are any other “gotchas” to watch out for since this is a non-standard configuration.Thanks for any advice you can provide.  Read More

​