This article describes a scenario where attempts to provision a user to Office 365 may fail with the following error message: Unable to update this object in Microsoft Online Services, because the attribute FederatedUser.UserPrincipalName is not valid.
Applies to: All versions of Centrify Identity Service with Office 365
Problem:
User failed to provision to Office 365 with the following unexpected error message in Centrify Sync Report:
Unable to update this object in Microsoft Online Services, because the attribute FederatedUser.UserPrincipalName is not valid. Update the value in your local Active Directory
Cause:
Office 365 does not allow changing the federated domain suffix of a user to a different federated domain suffix.
One scenario is: this user has already been synced to office 365 before and then the user’s UPN is now changed to a different federate domain suffix. After running a sync on that user, the above error message displays in Centrify sync report.
Workaround:
1. Install and run Windows Azure Active Directory Module for Windows PowerShell as administrator.
2. Run the following command, pressing Enter after each command:
Connect-MsolService
(Enter Office 365 admin credentials when prompted)
3. Run the command below to change the user's UPN to e.g. username@yourcompany.onmicrosoft.com:
- Replace [ExistingUPN] with the actual UPN that user currently is having in Office 365 (which can be found by searching user name in Office 365 admin portal, e.g. alias@domainsuffix.com.) - Replace [DefaultDomainUPN] with the UPN in the format of username@yourcompany.onmicrosoft.com, e.g. alias@acme.onmicrosoft.com.
4. Run the following command to set the user’s UPN to use the new federated domain:
- Replace [DefaultDomainUPN] with the UPN in the format of username@yourcompany.onmicrosoft.com, e.g. alias@acme.onmicrosoft.com. - Replace [NewUPN] with the UPN that uses the new federated domain.
5. Login to Centrify Cloud Manager. Either:
i. locate and right-click on this affected user and select “Sync All Apps” to sync this user again.
OR
ii. run a full sync in Settings > Provisioning > select the Office 365 app in the drop down list > Start Sync.
6. After sync, check the sync report to verify the user has been provisioned without error.