KB-5964: Sync failure when user account UPN changes to a different federated domain

Home >

KB-5964: Sync failure when user account UPN changes to a different federated domain

Product:

Centrify Identity Service, App Edition ,

Published:

8 August,16 at 04:26 PM

Rating:

Applies to: All versions of Centrify Identity Service with Office 365

Problem:

User failed to provision to Office 365 with the following unexpected error message in Centrify Sync Report:

Unable to update this object in Microsoft Online Services, because the attribute FederatedUser.UserPrincipalName is not valid. Update the value in your local Active Directory

Cause:

Office 365 does not allow changing the federated domain suffix of a user to a different federated domain suffix.

One scenario is: this user has already been synced to office 365 before and then the user’s UPN is now changed to a different federate domain suffix. After running a sync on that user, the above error message displays in Centrify sync report.

Workaround:

1. Install and run Windows Azure Active Directory Module for Windows PowerShell as administrator.

2. Run the following command, pressing Enter after each command:

      Connect-MsolService

(Enter Office 365 admin credentials when prompted)

3. Run the command below to change the user's UPN to e.g. username@yourcompany.onmicrosoft.com:

      Set-MsolUserPrincipalName -UserPrincipalName [ExistingUPN] -NewUserPrincipalName [DefaultDomainUPN]

- Replace [ExistingUPN] with the actual UPN that user currently is having in Office 365 (which can be found by searching user name in Office 365 admin portal, e.g. alias@domainsuffix.com.)
- Replace [DefaultDomainUPN] with the UPN in the format of username@yourcompany.onmicrosoft.com, e.g. alias@acme.onmicrosoft.com.

4. Run the following command to set the user’s UPN to use the new federated domain:

      Set-MsolUserPrincipalName -UserPrincipalName [DefaultDomainUPN] -NewUserPrincipalName [NewUPN]

- Replace [DefaultDomainUPN] with the UPN in the format of username@yourcompany.onmicrosoft.com, e.g. alias@acme.onmicrosoft.com.
- Replace [NewUPN] with the UPN that uses the new federated domain.

5. Login to Centrify Cloud Manager. Either:

i. locate and right-click on this affected user and select “Sync All Apps” to sync this user again.

OR

ii. run a full sync in Settings > Provisioning > select the Office 365 app in the drop down list > Start Sync.

6. After sync, check the sync report to verify the user has been provisioned without error.

For further info, see Microsoft KB regarding this issue: https://support.microsoft.com/en-us/kb/2669550(Link provided as a courtesy)

For additional information not covered in this guide or troubleshooting assistance, please review Centrify Online Help or visit the Customer Support Portal at https://www.centrify.com/support/customer-support-portal/