Identify users and get their OIDCONFLICT ids. Then check post for instructions how to remove CONFLICT users: https://www.linkedin.com/posts/yuriy-v-popov_azuredevops-devops-oidconflict-activity-7412549794000220160-b4oH
Cannoct connect to Azure Devops with Entra user after changing UPN Suffix
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(140.8, 44%, 23%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EJF%3C/text%3E%3C/svg%3E)
Joffrey Fontaine
0
Reputation points
Hello, i had an ADO organization, i switch directory to another entra, went well.
after that, I bind ADO users to Entra USERS, went well.
because there is a domain migration between old and new tenant, i wanna change the UPN suffix of users in the new entra. And after that, users in ADO keep the old UPN (because is suppose the OID don't change, so no new bind required) and now, ADO says there is an error with this user, but dont wanna link with the new UPN and so users cannot login into ADO.
is there a way to update the user in ADO without deleting it and re-inviting it ? (because lot of workitems associate with the users)
thanks
Joffrey
Azure DevOps
-
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(128, 8%, 22%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EA%3C/text%3E%3C/svg%3E)
Anonymous2025-04-04T08:08:06.75+00:00 Hello @Joffrey Fontaine,
To update a user's UPN in Azure DevOps without deleting or re-inviting them, update the user's UPN in Azure AD to reflect the new suffix. Then, trigger a sync in Azure DevOps by either manually updating the user’s profile or using the Azure AD synchronization feature in ADO settings. This will update the user's UPN while preserving their work items and permissions, as the OID remains unchanged. Make sure to check for cached credentials during login.
-
Anonymous
2025-04-07T04:43:15.2833333+00:00 Joffrey Fontaine, Did you get a chance to see my previous comment? In case if you have any resolution, please do share that same with the community as it can be helpful to others. Otherwise, please respond with more details and we will try to help.
Sign in to comment
2 answers
Sort by: Most helpful
-
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(80, 40%, 17%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3ER%3C/text%3E%3C/svg%3E)
RE 0 Reputation points2025-12-01T14:55:20.6+00:00 We had a similar issue and the users had to sign in (InPrivate browser) using the new UPN/email and they were able to log in. As soon as they did, it worked and pushed the change through to DevOps and the email changed.
Before that we seemed to be stuck in a loop where sending an invite wouldn't let them in.