How to reassign/rematch an AD user with a M365 user account?

Question

I'm taking over a client from a previous service provider. They managed separate AD on-premise and M365 environments so that passwords and even usernames weren't aligned or consistent.

For example, most users were given the identity first-initial + last-name, while some were given the identity firstname only. (They want to use first-initial + last-name).

I enabled Microsoft Entra Cloud Sync prematurely and changed these users on the local AD server to use the new convention. The M365 account with bsmith@example.com is the active account. So now I have situations where account DOMAIN\bsmith has 2 accounts in M365, one for bob@example.com (which is synced from the on-premises server but has no M365 licenses associated with it) and bsmith@example.com which isn't synced from the on-premise server but has all of Bob's email and OneDrive data?

How do I detach the on-premises account DOMAIN\bsmith from syncing to M365's bob@example.com, and instead attach it to the M365 account: bsmith@example.com without deleting Bob's active M365 account bsmith@example.com?

Answer 1

Hi @Atlas Business Solutions , to reassign the on-premises account DOMAIN\bsmith to the M365 account [bsmith@example.com], you can follow these steps:

1. Update the UserPrincipalName (UPN) attribute in your on-premises Active Directory for the user DOMAIN\bsmith to match the desired M365 account ([bsmith@example.com]).
2. Make sure the feature to synchronize UPN changes for managed users is enabled in your Azure AD directory. You can check this by running the following PowerShell command: Get-MsolDirSyncFeatures -Feature SynchronizeUpnForManagedUsers
3. If it's not enabled, enable it with: Set-MsolDirSyncFeature -Feature SynchronizeUpnForManagedUsers -Enable $true
4. Run a delta sync on your Azure AD Connect to synchronize the updated UPN attribute to Azure AD. After completing these steps, the on-premises account DOMAIN\bsmith should be synced with the M365 account [bsmith@example.com]. The previously synced account ([bob@example.com]) will remain in M365, but you can remove it if it's no longer needed.

Please note that changing the UPN for federated users is allowed since March 2019. Make sure to backup any important data before making these changes.

Please let me know if you have any questions and I can help you further.

If this answer helps you please mark "Accept Answer" so other users can reference it.

Thank you,

James