Forum Discussion

Blacksuit's avatar
Blacksuit
Copper Contributor
Apr 05, 2022

Set AD User with External Email Address

I am setting up a co-lo for 2 companies in 1 office space. These companies are sister companies but infrastructure has been separated for legal reasons but we are converting into a hybrid office envi...
Active Directory
email address
Email routing
O365
Blacksuit's avatar
Blacksuit
Copper Contributor
Apr 15, 2022
I thought about leaving their workstations as is but since budget is very tight I dont have enough desks and equipment for both companies. Company A and B rotate coming into the office which in lies the issue. The machines at the office are for duel use which is why they were joined to 1 domain. The machines at home are still on their original domain. Either way the situation is not ideal but we have to manage going forward until things change and we can split fully again. That is why I was hoping there was a way to add their external email addresses...
LainRobertson's avatar
LainRobertson
Silver Contributor
Apr 15, 2022

Blacksuit 

 

I think you've misunderstood how UPN suffix routing works in Active Directory, and it's relationship to Exchange.

 

Also, knowing that Company A is also on Exchange Online and not Exchange Server (which is on-premise) helps.

 

I'm going to make what I expect is a safe assumption here: Company A is likely running AAD Connect for synchronising objects from on-premise Active Directory to Azure AD.

 

So, while my preferred option your scenario would be the Azure AD Domain Services model from above, you can "shoe horn" in other less desirable solutions. The thing is, these other options clearly run against the principles of legal separation, but I've mentioned that enough already and won't bang on about it again here.

 

What I would do - in line with what I suggested initially when I was guessing what the two company's looked like - is that you add Company B's domain name into Company A's forest as an additional UPN suffix.

 

What this does

The userPrincipalName can end with the new suffix, for example Email address removed.

 

What this does not do

This does not impact the server-side configuration of mail in any way, shape or form.

 

What you need to do with AAD Connect

Filter or scope out any accounts aligned to "@companyb.com" so that it ignores them entirely. You can do scoping using the AAD Connect configuration wizard easily enough. Filtering involves some more steps but offers more control over what it synchronised.

 

This gives you the easiest configuration to manage because you are not integrating Company B into Company A from a mail perspective at all.

 

The biggest downside to this approach you've taken with putting Company B's users into Company A's forest is that their passwords will not be in sync with their password from Azure/Office. The Azure AD DS trust model avoids this.

 

The Microsoft links from above explain more advanced models, such as the single on-prem forest to multiple Azure AD tenant model, but I'll leave it to you to read those links as there's a lot of cause-and-effect considerations for you to plan around.

 

Cheers,

Lain

Resources