Applications that use Just in Time provisioning to create a user profile when users sign in to the app for the first time can be affected by UPN changes.Ĭhanging a user's UPN could break the relationship between the Azure AD user and the user profile created on the application.
#Principle app for ios software
Software as a service (SaaS) and Line of Business (LoB) applications often rely on UPNs to find users and store user profile information, including roles. The following sections detail potential known issues and workarounds when UPNs are changed. We recommend having a tested procedure that includes documentation about known issues and workarounds. Include this information on your user communications.Ĭreate a defined procedure for changing UPNs on individual users as part of normal operations. Going through this first subset of users will give you a good idea of what users should expect as part of the change. Once your pilot is running, you can start targeting small sets of users with various organizational roles and their specific sets of apps or devices. Also have a tested rollback plan for reverting UPNs if you find issues that can't be quickly resolved. Roll-out bulk UPN changesįollow the best practices for a pilot for bulk UPN changes. If the value of the userPrincipalName attribute doesn't correspond to a verified domain in Azure AD, the synchronization process replaces the suffix with a default. When you're synchronizing user accounts from Active Directory to Azure AD, ensure that the UPNs in Active Directory map to verified domains in Azure AD. See the Known issues and workarounds in this document.
#Principle app for ios update
It's important that you have a defined process when you update a User Principal Name (UPN) of a single user, or for your entire organization. You can change it to a different attribute in a custom installation. By default the Azure AD Connect wizard uses the userPrincipalName attribute from the on-premises Active Directory as the UPN in Azure AD.
When you use Azure AD in conjunction with your on-premises Active Directory, user accounts are synchronized by using the Azure AD Connect service. Users sign in to Azure AD with the value in their userPrincipalName attribute. They would then you are changing the suffix in Active Directory, you must ensure that a matching custom domain name has been added and verified on Azure AD. If you create the user account in the domain, the default UPN you can add more UPN suffixes by using Active Directory domains and trusts.įor example, you may want to add and have the users' UPNs and email reflect that. In most cases, this is the domain name that you register as the enterprise domain on the internet. In Active Directory, the default UPN suffix is the DNS name of the domain where you created the user account. to to recommend to change users' UPN every time their primary email address is updated.ĭuring the initial synchronization from Active Directory to Azure AD, ensure the users' emails are identical to their UPNs.You can change a UPN by changing the prefix, suffix, or both.įor example, if a person's name changed, you might change their account to might also change the corporate standard for to the suffix.įor example, if a person changed divisions, you might change their domain: Users' primary email addresses might change for many reasons:Įmployees moving to different company divisions
Therefore, you should be sure to change users' UPN anytime their primary email address changes. Sign-in pages often prompt users to enter their email address when the required value is actually their UPN. For developers, we recommend that you use the user objectID as the immutable identifier, rather than UPN or email addresses as their values can change.
0 kommentar(er)
