unable to login using onmicrosoft.com

Question

Hi
Azure AD is cloud only, user UPN is username@keyman .com
user can login using username@keyman .com but user cannot login using username@X .onmicrosoft.com ( xxx.onmicrosoft.com is the issuer domain)

We are planning to move users to a different tenant using same domain name, but we do not want to lose access to the old tenant.

is there a way user can login using username@X .onmicrosoft.com or do we have to create a generic user with global admin right to login to the tenant?

Thanks

Answer 1

Change the UPN in Azure for those users to the onmicrosoft.com one or create a breakglass GLobal Admin account and set that to the onmicrosoft.com UPN suffix

Answer 2

Hey @Jamal Ahmed ,
So if I am understanding the question correctly You are planning a tenant to tenant migration in which you will be migrating the domain(@keyman .com) and users to Newtenant.onmicrosoft.com however you want users to still have access to the old tenant(@oldtenant.onmicrosoft.com).

Before AAD will even let you remove the domain from the current tenant to move it to the new tenant it will require you to remove all proxy addresses with that domain and change every UPN in your tenant to another current accepted domain(oldtenant.onmicrosoft.com for example) as you cannot have one domain under two tenants. So for your cloud only objects when you switch the UPN for the users in your old tenant that need access to the tenant under @oldtenant.onmirosoft.com make it ******@oldtenant.onmirosoft.com. They will then be able to login to the old tenant with ******@oldtenant.onmicrosoft.com and(post migration) the new tenant with user@keyman .com. This will require they have a user object on both tenants. For hybrid synced objects this is more complicated as the source of authority for these objects is AD on prem which you will likely need to point to your new tenant during Migration. This has multiple possible resolutions.
I recommend checking out the Tenant to Tenant Architecture model found here: https://learn.microsoft.com/en-us/microsoft-365/enterprise/microsoft-365-tenant-to-tenant-migrations?view=o365-worldwide

If you find this answer helpful remember to mark the question as answered.

Regards,
-Wes

Answer 3

Author's problem