2

I've been looking for an answer to this here and in other places, but I can't seem to find one.

I have a client with a single on-prem Active Directory domain. One forest, one domain. There are other on-prem servers which use it for authentication. Client software also uses AD for authentication.

I am setting them up with Office 365 for e-mail and other services, and I don't want them to have to manage their domain and Azure accounts separately. I'll be using Azure AD to keep them in sync.

The on-prem domain uses a subdomain of the company's public domain (i.e. ad.company.com) which is not in the public DNS record, and I want their e-mail addresses and Azure accounts to be [email protected]. Is there something special I need to do for this to work? Are there any pitfalls I need to be aware of?

Thanks!

1 Answer 1

2

No. It just works. It's not uncommon for organisations to have different DNS namespaces for their AD and SMTP domains so you're not on your own here.

There's literally no trick or workaround required, just set it up and it works. In our org we synced from a DC in a child domain to Azure and Office 365 for mail. We have another domain in the forest also doing the same. Their domain is at least in the same namespace as the SMTP domain (even though it's not the same sub-domain), ours isn't in in the same namespace. Both work fine.

There are some other considerations if you have a setup like this (i.e. multiple tenants in the same forest), but for what you're doing it sounds like it's not going to be a problem.

TL;DR it's not even a consideration. It will be fine.

4
  • The only consideration is that the user's UPNs must match their email addresses. So, if the local AD is ad.company.com, and the email address is [email protected], the UPN must be [email protected].
    – user332904
    Feb 27, 2017 at 3:26
  • I assumed that the company public domain is the on-premises top level domain, which is also a parent domain. Then, the UPN of domain accounts can be changed to the parent domain from the local AD, and the accounts will be synced to Azure AD associated with the parent domain. Feb 28, 2017 at 9:03
  • 1
    The user's UPN most certainly does NOT have to match their email address.
    – JBaldridge
    Feb 28, 2017 at 23:33
  • The root on-prem domain is ad.company.com. Is it possible to change the UPN to the root domain if I have no domain controller using it? Mar 2, 2017 at 9:29

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .