1

We have 2 domains. TestCenter.org and TestProject.org.

Server 2012 R2 Running AD and ADFS

We have an Exchange 2010 server running as well

All users have an email address for the TestCenter.org. However the AD Domain is the TestProject.org domain

I have set up exchange offline mail archive through O365. And I am trying to configure it to work with Single Sign on.

When I create a remote email archive for a user it goes through the hybrid exchange setup and creates the mail archive in Office 365. The user is then prompted on their outlook to input credentials for office 365. So the SSO isn't working.

If the user uses the user@TestProject.org username the sign on works and the archive folder appears in their mailbox, everything is fine. But the user is using the TestCenter.org domain for their email.

If I change the users logon domain to TestCenter.org in AD, then they are never prompted in outlook and no archive folder ever shows up. Once I change their logon domain back to TestProject.org the prompt pops up.

If I run the MS connectivity analyzer to test SSO on O365 using the user@testProject.org, it passes. But if I use user@TestCenter.org it fails saying invalid username / password, everything else passes on the test.

So how can I allow the TestCenter.org domain to authenticate to the TestProject.org doamin so SSO will work properly?

Thank you,

3
  • Do you have some users who have UPN suffixes of testproject.org and others who have UPN suffixes of testcenter.org? Or are you trying to migrate from one UPN suffix to another? You have ADFS and Dirsync running and working? Can users log on to the portal using either suffix? – Todd Wilcox Feb 25 '16 at 19:33
  • Using the ADFS web portal: user@TestProject.org is working. user@TestCenter.org is NOT working. Everyone currently uses the TestProject.org UPN suffix, the TestCenter.org UPN suffix is added and available. It shows both domains as federated. In office 365 both domains are added and both show they are configured for SSO – Gummby8 Feb 25 '16 at 19:57
  • A user can only have and log on with one UPN at a time. If you change a user's UPN on-premise you have to manually run or wait for dirsync to happen so that the cloud has the updated UPN suffix also. I think you'll have problems with autodiscover if the UPN does not match the primary e-mail address. – Todd Wilcox Feb 25 '16 at 20:02
1

Thanks Todd I did need to change the UPN to match, but...

Turns out dirsync or now known as azure AD connectwon't change a UPN. For those that come after me

connect-MSOLService

Set-MsolUserPrincipalName -UserPrincipalName user@TestProject.org -NewUserPrincipalName user@testcenter.onmicrosoft.com

Set-MsolUserPrincipalName -UserPrincipalName user@testcenter.onmicrosoft.com -NewUserPrincipalName user@testcenter.org

1
  • Oh right, good point. You can change the UPN suffix in the admin portal also (in the Edit User screen, until Details (on the left), the last normal detail is User Name and there is a UPN suffix drop-down there). Of course for federated domains you have to make sure the on-premise and cloud UPN suffixes are the same or else ADFS logons will not work. – Todd Wilcox Feb 25 '16 at 21:22

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.