'%3e%3cpath%20d='M8%200C12.4183%200%2016%203.58172%2016%208C16%2012.4183%2012.4183%2016%208%2016C3.58172%2016%200%2012.4183%200%208C0%203.58172%203.58172%200%208%200ZM11.6162%204.38379C11.2257%203.99337%2010.5927%203.99338%2010.2021%204.38379L8%206.58594L5.79785%204.38379C5.40732%203.99334%204.77429%203.99329%204.38379%204.38379C3.99331%204.77429%203.99335%205.40733%204.38379%205.79785L6.58594%208L4.38379%2010.2021C3.99348%2010.5927%203.99341%2011.2257%204.38379%2011.6162C4.77426%2012.0066%205.40734%2012.0065%205.79785%2011.6162L8%209.41406L10.2021%2011.6162C10.5927%2012.0066%2011.2257%2012.0067%2011.6162%2011.6162C12.0067%2011.2257%2012.0066%2010.5927%2011.6162%2010.2021L9.41406%208L11.6162%205.79785C12.0066%205.40735%2012.0066%204.77429%2011.6162%204.38379Z'%20fill='%23080E17'%20fill-opacity='0.46'/%3e%3c/g%3e%3cdefs%3e%3cclipPath%20id='clip0_3761_713'%3e%3crect%20width='16'%20height='16'%20fill='white'/%3e%3c/clipPath%3e%3c/defs%3e%3c/svg%3e)
How to Fix Azure AD Connect UPN Suffix Mismatch During Synchronization
Question details
The user needs to resolve a User Principal Name (UPN) suffix mismatch error during identity synchronization between an on-premises domain and Microsoft 365 without causing email service disruption.
- Product
- Azure AD Connect
- Device & OS
- not provided
- Scenario
- Synchronizing on-premises Active Directory users to Microsoft 365 (Microsoft Entra ID) where the local domain differs from the cloud domain.
- Observed behavior
- Azure AD Connect reports an error stating that user principal name suffixes must match because the on-premises domain is configured differently than the Microsoft 365 domain.
Before making changes to your Active Directory UPN suffixes, ensure you have global administrator access to your Microsoft 365 tenant and domain administrator privileges for your on-premises environment.
Seek Specialized Guidance from Microsoft Entra ID Support
Because this is a core identity synchronization issue involving Microsoft Entra ID and Active Directory, consulting specialized support is the safest way to avoid email routing disruptions.
UPN suffix mismatches are complex identity synchronization issues rather than standard Exchange Online problems. Direct modifications without proper planning might impact user sign-ins or email delivery.
Open your web browser and go to the official Microsoft Learn Q&A section specifically dedicated to Microsoft Entra ID.
Create a new post detailing your specific topology, mentioning that your on-premises domain (@a.domain-name.co.uk) differs from your Microsoft 365 domain (@domain-name.co.uk).
Tag your question with both 'Microsoft Entra ID' and 'Active Directory' to ensure it is routed to the identity synchronization specialists for accurate guidance.
Add an Alternative UPN Suffix in Active Directory
If you are an experienced system administrator, you can manually add the Microsoft 365 domain as an alternative UPN suffix in your on-premises Active Directory to resolve the mismatch.
Empower Your Team with WPS Office While Managing IT Infrastructure
While resolving complex identity synchronization and Microsoft 365 server issues, ensure your team stays productive with a lightweight and cost-effective office suite. WPS Office is a powerful alternative that provides seamless document editing without the heavy overhead.
Frequently Asked Questions
Why does Azure AD Connect require matching UPN suffixes?
Azure AD Connect uses the User Principal Name (UPN) to uniquely identify users during synchronization. If the on-premises UPN suffix is not added and verified in your Microsoft 365 (Entra ID) tenant, the system replaces the unrecognized suffix with the default .onmicrosoft.com domain, leading to login issues.
Will changing the UPN suffix in Active Directory break user emails?
Changing the UPN suffix updates the user's login ID but does not inherently delete or modify their primary SMTP address used for email routing. However, users will need to use the new UPN (which now matches their email address) to authenticate into Microsoft 365 services.
What is the difference between Microsoft Entra ID and Active Directory?
Active Directory (AD) is a legacy on-premises identity and access management system running on Windows Server. Microsoft Entra ID (formerly Azure AD) is Microsoft's cloud-based identity service used to manage access to Microsoft 365 and other cloud applications.
