'%3e%3cpath%20d='M8%200C12.4183%200%2016%203.58172%2016%208C16%2012.4183%2012.4183%2016%208%2016C3.58172%2016%200%2012.4183%200%208C0%203.58172%203.58172%200%208%200ZM11.6162%204.38379C11.2257%203.99337%2010.5927%203.99338%2010.2021%204.38379L8%206.58594L5.79785%204.38379C5.40732%203.99334%204.77429%203.99329%204.38379%204.38379C3.99331%204.77429%203.99335%205.40733%204.38379%205.79785L6.58594%208L4.38379%2010.2021C3.99348%2010.5927%203.99341%2011.2257%204.38379%2011.6162C4.77426%2012.0066%205.40734%2012.0065%205.79785%2011.6162L8%209.41406L10.2021%2011.6162C10.5927%2012.0066%2011.2257%2012.0067%2011.6162%2011.6162C12.0067%2011.2257%2012.0066%2010.5927%2011.6162%2010.2021L9.41406%208L11.6162%205.79785C12.0066%205.40735%2012.0066%204.77429%2011.6162%204.38379Z'%20fill='%23080E17'%20fill-opacity='0.46'/%3e%3c/g%3e%3cdefs%3e%3cclipPath%20id='clip0_3761_713'%3e%3crect%20width='16'%20height='16'%20fill='white'/%3e%3c/clipPath%3e%3c/defs%3e%3c/svg%3e)
Fix UPN Changing to Email After Invalid Password in Microsoft Entra ID
Question details
Users experience an authentication issue where their non-email UPN is automatically replaced by their email address on the sign-in screen after entering an incorrect password.
- Product
- Microsoft Entra ID
- Device & OS
- not provided
- Scenario
- A user attempts to sign in to a Microsoft service using a non-email User Principal Name (UPN) but enters an invalid password.
- Observed behavior
- The sign-in interface unexpectedly converts the non-email UPN to a valid email address without completing authentication, causing the next login attempt to fail and potentially exposing user information.
Ensure you have global administrator or authentication administrator privileges in the Microsoft Entra admin center to review and modify tenant sign-in and synchronization policies.
Verify Hybrid Authentication and Alternate Login ID Settings
Check if the 'Email as alternate login ID' feature is enabled, as this can cause the system to resolve the UPN to an email address during the authentication flow.
In hybrid environments, configuration settings related to Microsoft Entra Connect can alter how identifiers are processed. Disabling or verifying these settings is the first step in troubleshooting identifier changes.
Sign in to the Microsoft Entra admin center using your administrator credentials.
Go to Identity in the left menu, expand Hybrid management, select Microsoft Entra Connect, and click on Connect Sync.
Review the settings to determine if 'Email as alternate login ID' is enabled. If it is, this may be causing the automatic conversion.
Ensure that the UPN domain being used is fully validated and correctly synchronized within your tenant.
Review Sign-in Logs and Escalate to Microsoft Support
If the alternate login ID feature is already disabled but the UPN still converts to an email address, investigate the sign-in logs and escalate the issue to address potential information disclosure.
Try WPS Office for a Seamless and Independent Workspace
If complex enterprise login issues and cloud synchronization problems are disrupting your workflow, consider using WPS Office. It provides a lightweight, offline-capable environment for document editing without relying on strict cloud domain authentications.
- 1. Download the installer: Visit the official WPS Office website and click the 'Download WPS Office Free' button.
- 2. Install the software: Run the downloaded file and follow the simple on-screen instructions to install the suite on your device.
- 3. Start working instantly: Open WPS Office and begin creating or editing your documents immediately, with or without a cloud sign-in.
Frequently Asked Questions
What is 'Email as alternate login ID' in Microsoft Entra?
It is a feature that allows users to sign in to Azure AD/Microsoft Entra using their primary email address instead of their UPN. This is often used when an organization's UPN is non-routable or overly complex.
Why does my UPN change to an email address after a failed password attempt?
This typically happens if hybrid authentication features attempt to resolve the user's identity to a known email address. However, if 'Email as alternate login ID' is disabled, this conversion may be an unexpected service-side behavior in the authentication flow.
Is it a security risk if the UPN changes to an email address before authentication?
It can be considered an information disclosure risk, as it potentially reveals a user's valid email address to someone who only knows the UPN, even if they failed to provide the correct password.
