Change User Logon Name in Active Directory for Hybrid Identity to Entra ID

When transitioning to a hybrid identity setup in Microsoft Entra ID and changing the User Principal Name (UPN) suffix in Active Directory from a non-routable domain (like .local) to a routable domain (like .com), there are several important considerations and potential impacts to be aware of:

1. Application Compatibility:
   • Ensure that any applications, scripts, or services that authenticate using the current UPN (user@domain.local) can handle the change to the new UPN (******@domain.com). Some applications might have hardcoded domain references or may not handle UPN changes well.
2. User Experience and Communication:
   • Inform users about the change as it will affect their login experience. They will need to start using the new UPN for sign-ins.
   • Check if users have saved login credentials in their applications or browsers, as these might need to be updated.
3. Email Address Considerations:
   • If the users already have email addresses with @domain.com, ensure that the new UPN doesn’t conflict with existing email addresses.
   • Changing the UPN to match the email address can simplify the user experience, but it's important to ensure consistency across systems.
4. Directory Synchronization:
   • If you're using Azure AD Connect, ensure it is configured to sync the new UPN suffix. The change in UPN will be synchronized to Azure AD/Microsoft 365, so you should verify that Azure AD Connect sync rules are properly configured.
   • Test the change with a few accounts before rolling it out organization-wide to make sure it syncs correctly and doesn't cause unforeseen issues.
5. Authentication Flows:
   • Evaluate any impact on authentication flows, especially if you are using federation services like ADFS. Ensure that the federated domain setup aligns with the new UPN suffix.
6. Group Policy and Scripts:
   • Review any Group Policies or login scripts that might use or reference the old domain. These may need to be updated to reflect the change.
7. Certificate Implications:
   • If you have certificates that are tied to user accounts or use UPN as an identifier, check the impact of UPN changes on these certificates.
8. Licenses and Subscriptions:
   • In Microsoft 365, review any licenses or subscriptions that may be tied to user accounts to ensure they remain correctly assigned post-UPN change.
9. Impact on Linked Systems:
   • Consider the impact on any other systems linked to your Active Directory, such as SharePoint, Lync/Skype for Business, CRM systems, etc.
10. Backup and Recovery Plan:
    • Have a rollback plan in case the change leads to unexpected issues. Ensure you have a current backup of your AD environment before making changes.
11. Documentation Update:
    • Update any documentation that references the old domain to avoid confusion.

By carefully considering these factors and testing the change in a controlled manner, you can mitigate potential issues and ensure a smooth transition for your users. If you find this information useful, please consider accepting this answer, and feel free to ask any further questions.

Hi @Muhammad Farid Rahmatulloh
Thank you for posting your query on Q&A.

I understand that you are trying to change the user logon name in Active Directory (AD) from user@domain.local to ******@domain.com.
Changing user logon name should not have any impact. It will not change permissions, membership of user because the user SID (Security ID) will not change. How ever inform the users to use new logon name for consistency and convenience.
If you have any applications or services that depends on former user log on name might not change the new logon name and the userPrincipalName (UPN) attribute might not recognize the UPN change the application administrator may need to do manual changes to fix the relationship. for more information, please check here.
Before implementing on production, it is best practice to test this operation on a single user account.

I hope this answer helps! If you have any further questions, please feel free to ask.

Reference: https://serverfault.com/questions/522621/what-do-i-need-to-be-cautious-of-when-changing-a-user-logon-name-in-active-direc
https://learn.microsoft.com/en-us/entra/identity/hybrid/connect/howto-troubleshoot-upn-changes

Thanks,

Akhilesh.

Please "Accept the answer" if the information helped you. This will help us and others in the community as well.