Forum Discussion

Mark Murrin's avatar
Mark Murrin
Copper Contributor
Oct 06, 2017

Office 365 + local domain .local and external .com shows Users will not be able to sign-in azure ad?

We have office 365 premium.. i've set up our .com domain in the admin portal.. ran through the steps, except i did not add dns entries.. (we will do hybrid, both on site offsite for now, ie: exchange...
Azure Active Directory (AAD)
microsoft 365
Mark Murrin's avatar
Mark Murrin
Copper Contributor
Oct 06, 2017
Thats the part i havent done is add the suffix using the powershell command.. i'm a bit nervous about running it.. doesnt it also change each user to the .com as the way to log in to their machines.. would they know its changed without me stating.. ie: i guess only if they log off and back onto their win 10 machines? Any chance this breaks anything onsite by making them use .com? IE: our local skype is using servername.domain.local for the pool at least.
VasilMichev's avatar
VasilMichev
MVP
Oct 06, 2017

Not sure which PowerShell cmdlet you are referring to, but adding the suffix in the AD Domains and Trust snap-in is harmless. Changing the user's UPN to reflect the new suffix will change the way they login to some applications, but the old domain\samaccountname method will continue to work.

  • Mark Murrin's avatar
    Mark Murrin
    Copper Contributor
    Oct 06, 2017

    Ah ok.. so either way no harm even with a brute force command line method?
    I think either way, for single sign on to work as it should with exchange online later on, they all need to sign in via .com anyway.. so i'm guessing this is fine


    Here is the article for the command line/powershell  https://blogs.technet.microsoft.com/canitpro/2015/07/07/step-by-step-changing-the-upn-suffix-for-an-entire-domain-via-powershell/#comment-234715ell

    • Mark Murrin's avatar
      Mark Murrin
      Copper Contributor
      Oct 06, 2017

      I added the suffix to the domain.. refreshed the azure ad connect sign in page..

       

      now it shows under ad upn suffix BOTH domain.local and domain.com.. domain.local under azure ad domain says not added.. and the domain.com says verified..

       

      At the bottom it still says users will not be able to sign in using on premises creds.. unsure why though.. 

      • VasilMichev's avatar
        VasilMichev
        MVP
        Oct 07, 2017

        Probably because it detect the users with the .local suffix.

Resources