Forum Discussion

meanoldmanning's avatar
meanoldmanning
Copper Contributor
Nov 21, 2018

Question regarding UPN and AD pass through

Hello and pardon the question if I missed the answer elsewhere.   We are finally migrating off on prem to O365. I would like to use pass through authentication but have questions about the UPN, pub...
office 365
ChrisWebbTech's avatar
ChrisWebbTech
MVP
Nov 21, 2018
Yes you can use the UPN as it will carry over when syncing along with your primary e-mail and it needs to be added as a domain to the tenant. You can use Passthrough without exchange onprem but i would recommend keeping one as it makes administration easier. Many others have removed their exchange servers and do their admin through AD attributes so it's optional. Until you plan to completely remove AD sync and stand alone in 365 in the future I would say keep it around.
  • meanoldmanning's avatar
    meanoldmanning
    Copper Contributor
    Nov 21, 2018

    Second question re. your reply - keeping an exchange server on prem, it's just acting as a management console basically since non of the mail data is stored locally nor does it pass through that server, correct? So I could set up a tiny VM with just Exchange whatever version installed and not have to worry about space for the data, nor CALs since the client licenses are now O365?

    • ChrisWebbTech's avatar
      ChrisWebbTech
      MVP
      Nov 21, 2018
      After migration you could. Check out hybrid license thou cause the server still needs a license. It’s free, if you already have an exchange license thou you can still use that but eventually you’ll want to change. But your right no cals needed if moved to cloud and used for management only. Just server license being what you had or new server with hybrid.
      • meanoldmanning's avatar
        meanoldmanning
        Copper Contributor
        Nov 27, 2018

        We're licensed for Business Essentials, not E3 or better, so I don't think I can use the free key. I have an entitlement to on prem Exchange 2016 though, but not enough CALs for every user at that level. I'll have to investigate my options further. It may wind up we elevate to E3.

  • meanoldmanning's avatar
    meanoldmanning
    Copper Contributor
    Nov 21, 2018

    Chris, thanks for your reply,

     

    I think I found an article I was looking for. I skimmed this a couple weeks ago and then couldn't remember where I saw it. So yeah, should be OK based on this, I'll just have to add my private AD domain name to the list.

     

    "Azure AD Connect synchronizes your users' UPN and password so that users can sign in with the same credentials they use on-premises. However, Azure AD Connect only synchronizes users to domains that are verified by Office 365. This means that the domain also is verified by Azure Active Directory because Office 365 identities are managed by Azure Active Directory. In other words, the domain has to be a valid Internet domain (for example, .com, .org, .net, .us, etc.). If your internal Active Directory only uses a non-routable domain (for example, .local), this can't possibly match the verified domain you have on Office 365. You can fix this issue by either changing your primary domain in your on premises Active Directory, or by adding one or more UPN suffixes."

Resources