Msol Sign-in Address

Question

Need some help from Experts who have faced this challenge.

Environment: onPrem AD and AAD user authentication is pass through via AAD Connect.

Issue
We have user AAD UPN John@keyman .net different then our company primary Email address like John.Smith@keyman .com

edsaUPNPrefix = John
edsaUPNSuffix = Domain.net
mailNickname = John.Smith
SamAccountName = John

where Domain.net is not a public Domain. we try to change the UPN in AAD connector to use Email address as UPN but user was failed to Sign in because Username was not same as UPN in AD.

if we add Domain.com as another UPN suffix and change the edsaUPNSuffix to Domain.com, it will works. but i want to know what other opens do we have.

Answer 1

It's either that or use alternateID, which has some bigger downsides: https://learn.microsoft.com/en-us/azure/active-directory/authentication/howto-authentication-use-email-signin