Azure AD Connect OnPremisesUserPrincipalName AuthorativeNull

Kent Hanna 6 Reputation points
2022-11-17T19:42:53.617+00:00

I'm trying to convert a user to an Internal Guest for B2B collaboration based on this article:
https://learn.microsoft.com/en-us/azure/active-directory/external-identities/invite-internal-users?source=recommendations

My problem is setting the onPremisesUserPrincipalName attribute to be null.

In AD Connect I created an Outbound rule, with our Azure AD connector, scoped it to a specific user, and added a transformation> Expresssion:onPremisesUserPrincipalName:AuthoratitiveNull:Update

When I preview the change in the Connector Space Object Properties I can see the Data Source AuthoritiveNull on the onPremisesUserPrincipalName attribute with a value of null.

However, the null value never gets applied to the user account in Azure AD.
What am I doing wrong?

Microsoft Entra External ID
Microsoft Entra External ID
A modern identity solution for securing access to customer, citizen and partner-facing apps and services. It is the converged platform of Azure AD External Identities B2B and B2C. Replaces Azure Active Directory External Identities.
2,662 questions
Microsoft Entra ID
Microsoft Entra ID
A Microsoft Entra identity service that provides identity management and access control capabilities. Replaces Azure Active Directory.
19,664 questions

1 answer

Sort by: Most helpful
Most helpful Newest Oldest
  1. Marilee Turscak-MSFT 34,306 Reputation points Microsoft Employee
    2022-11-21T17:49:10.923+00:00

    Hi @Kent Hanna ,

    Issue summary
    When converting synchronized users from Member type to Guest, the onPremisesUserPrincipalName attribute null value is reflected on premises and in the Connector space preview, but not in Azure AD.

    Potential resolution

    To synchronize the Guest users, you need to enable the synchronization of UserType. By default, the UserType attribute is not enabled for synchronization because there is no corresponding UserType attribute in the on-premises Active Directory. You need to update it to Guest since it will otherwise be set to Member for synchronized users.
    https://learn.microsoft.com/en-us/azure/active-directory/hybrid/how-to-connect-sync-change-the-configuration#enable-synchronization-of-usertype

    I'm not fully certain if this will resolve the UPN issue (since Graph will return shadowUPN if onpremisesuserprincipalname is null) but it should at least resolve the conversion issue.

    -

    If the information helped you, please Accept the answer. This will help us and other community members as well.