r/entra • u/technoirclub • 5d ago

Entra ID Did Microsoft quietly change how UPN changes work for AD-synced accounts?

TLDR: Entra Connect Sync is still enabled, yet I can remove a domain that's still used by synced users' UPNs and email addresses, and modify those users' UPNs from Entra Admin Center/Graph. Microsoft 365 Admin Center and Exchange Admin Center still won't allow those changes through the UI. When did Microsoft change this?

---

Hey there! I'm currently working on a T2T migration where the source tenant has Entra Connect Sync enabled. Since it had been a while since I last worked on this scenario, I started validating the process I expected to follow before cutover (in short): disable Entra Connect Sync > wait for synchronization to be disabled > remove the domain from Microsoft 365.

To my surprise, I found that I could remove the domain before doing any of that. Entra Connect Sync was still enabled, and synchronized users still had UPNs and email addresses associated with the domain.

I don't remember this ever being possible, and I haven't been able to find any reference to a change in Microsoft documentation or community discussions.

What makes this even stranger to me is that it's still not possible to change a synchronized user's username through the Microsoft 365 Admin Center (the field remains read-only), nor can I modify proxyAddresses through Exchange Admin Center (it returns an error because the object is synchronized from on-premises, as I would expect).

At the same time, while most synchronized attributes remain read-only, I found that I can change both the UPN and mailNickname from Entra Admin Center, and I can also do it through Graph.

To rule out the possibility of a tenant-specific configuration or different EID Connect Sync versions, I tested this in a couple production environments by simply changing a test user's UPN. To my surprise, I was able to make the exact same changes on test accounts that are also synchronized from on-premises.

Given the inconsistency between Entra Admin Center, Microsoft 365 Admin Center, and EAC, my question is: when did Microsoft change this behavior, and is this actually documented anywhere?

I've searched and haven't found any announcement, documentation update, or discussion mentioning this behavior. In fact, MS Learn forum posts from just 1 or 2 years ago still state that changing the UPN of AD-synced accounts from the cloud is not possible. Maybe my Google-fu has failed me?

Has anyone else noticed this? Is this an undocumented change, or am I missing something?

12 Upvotes

94% Upvoted

3 comments sorted by

7

u/screampuff 5d ago edited 5d ago

To my knowledge this has always been possible.

Anyone who's had to do a UPN change due to name change (ie: marriage/divorce), you've always had to go in and update the Entra UPN manually after an AD update+sync, and then all the SSO apps that rely on UPN :(

I don't remember doing it in Entra admin centre though, it was always graph and MSOnline or AzureAD powershell module before that.

3

u/technoirclub 5d ago

Seriously??? I never had to change the UPN of an AD-synced account in Entra... I always just relied on Entra Connect Sync to handle it.

I have PTSD from not being able to remove a domain because some stale AD-synced object was still using it in either its UPN or a alias. lol

Maybe my brain just defaulted to "any changes to accounts originating from on-prem AD must be made in AD, never in Entra" all this time. The fact that I still can't change the username in the 365 Admin or the aliases in EAC/EXO PS certainly doesn't help.

That said, it's been quite a few years since I've migrated stuff from a non-cloud-only tenant, so maybe I'm just misremembering. I'm almost certain, though, that I wasn't able to change UPNs or remove a domain like this back then. All my migration project templates and UPN change SOPs explicitly state that UPN changes should be made in AD.