How to Fix UPN Mismatch Between Active Directory and Microsoft Entra ID
Question details
The user needs to resolve a mismatch between a user's User Principal Name (UPN) in on-premises Active Directory and Microsoft Entra ID to fix sign-in and synchronization errors.
- Product
- Active Directory / Microsoft Entra ID
- Device & OS
- not provided
- Scenario
- Updating a user's email address and resolving PowerShell search and sign-in failures caused by conflicting UPNs across environments.
- Observed behavior
- PowerShell searches fail and Azure AD Connect synchronizes the wrong email address despite the user's email being updated locally.
Ensure you have administrative privileges in both your on-premises Active Directory and Microsoft Entra ID, and possess administrator access to the Azure AD Connect server.
Update the UPN Attribute and Force Delta Synchronization
Manually edit the user's Principal Name in Active Directory's advanced features and force a delta sync cycle to push the correct identity to Microsoft Entra ID.
When Azure AD Connect synchronizes the wrong email address or PowerShell cannot find the user, the issue often lies in a mismatch between the 'userPrincipalName' and 'mail' attributes. Updating these directly in the Attribute Editor resolves the conflict.
Open Active Directory Users and Computers. Click on the 'View' menu at the top and select 'Advanced Features' to reveal extended user properties.
Locate the affected user, right-click their account, and select 'Properties'. Navigate to the 'Attribute Editor' tab, find the 'userPrincipalName' attribute, and update it to the correct value.
In the same Attribute Editor window, locate the 'mail' attribute. Ensure that it matches the newly entered UPN value, and confirm that the UPN domain suffix is an accepted and verified domain in your Microsoft 365 admin center.
Log in to your Azure AD Connect server, open PowerShell as an administrator, and run the command: Start-ADSyncSyncCycle -PolicyType Delta to force the changes to Microsoft Entra ID.
Looking for a Hassle-Free Office Suite? Try WPS Office
While troubleshooting complex Microsoft Entra ID and Active Directory sync issues, you may want a productivity suite that doesn't rely on cloud directory synchronization. WPS Office is a highly compatible, free alternative to Microsoft Office that works flawlessly offline.
- 1. Download WPS Office: Visit the official WPS Office website and download the free installation package for your operating system.
- 2. Install the Software: Run the lightweight installer and follow the simple on-screen instructions to set up the suite in minutes.
- 3. Start Creating Offline: Launch WPS Office and instantly create or edit your existing Microsoft Office documents without worrying about cloud login errors.
Frequently Asked Questions
Why is Azure AD Connect synchronizing the wrong email address?
This typically occurs when the 'userPrincipalName' (UPN) or 'mail' attribute in the on-premises Active Directory differs from the cloud identity, or if the chosen domain suffix hasn't been verified as an accepted domain in Microsoft 365.
How do I force Azure AD Connect to sync changes immediately?
You can force a delta synchronization by opening PowerShell on your Azure AD Connect server and running the command: Start-ADSyncSyncCycle -PolicyType Delta.
What should I do if the UPN still doesn't update after forcing a sync?
Open the Synchronization Service manager on your Azure AD Connect server, inspect the connectors, and search for the user object in the metaverse to verify that the correct UPN is being processed without filtering errors.
How do I access the Attribute Editor in Active Directory?
Open Active Directory Users and Computers, click 'View' in the top menu, and check 'Advanced Features'. Afterward, right-click any user, select 'Properties', and the 'Attribute Editor' tab will be visible.
