SOLVED accounts

Copper Contributor

Hi, looking to understand more about the domain in O365 tenants, which I've seen some info here. We are looking to cleanup users in our tenant that was created quite some time ago.  We have hundreds of users with the instead of our company's domain that we've since added.  How have others done this cleanup?  Do you mass delete all users with the emails?  Is it correct to assume that all the accounts were added prior to us adding our company's domain?  What happens when you swith the default from to your companys primary domain?

13 Replies
best response confirmed by Jeff Medford (Microsoft)
The users were either created before you synced your domain or created manually in O365. You can switch their UPN to be your corporate domain instead of and users should then be able to login with their corporate credentials (assuming you are doing some form of AD Connect or Sync). The one limitation as far as I know is that after switching the UPN suffix their profile properties won't sync fully since the pre-existing properties will be preserved. At least that is what I've seen in practice.
a lot of companys start with accounts and after they add the domain they change it. you should check if you did not add aliasses to the accounts before deleteing. In another case they use the accounts for admin accounts so it is clear who is a admin. kr, Paul

my current client is using accounts for administrative purposes. Their admins use their domain accounts for day-to-day activities and when they need to do admin tasks, they open an in-private session to login with their account.

You can change these accounts to your public routable UPN which is normally the users email address. If you run the following command to change this using PowerShell Set-MsolUserPrincipalName -UserPrincipalName -NewUserPrincipalName or if you want to change lots of users you can import from a CSV file the list of addresses you want changed and changed to import-csv c:\temp\names.csv | foreach{Set-MsolUserPrincipalName -UserPrincipalName $_.Users -NewUserPrincipalName $_.Email }

@Erin Scupham   what am I doing?  All I am attempting to do is get things set up properly for O365

need help with getting o365 set up properly

@Erin Scupham 

This is an old discussion that doesn't appear to have been resolved - but it's the 1st thing that came up that seemed relevant from the threat analysis service for an email I was evaluating that looks like a phishing attack. I recently got that email through O365 and it was in a Junk folder. It looks to be rightly placed there. I'm a customer of O365 too.

From the link provided by the originator of this thread, Erin Scupham, the Microsoft documentation regarding "" seems to contradict what I'm seeing.

From the docs referenced above:

The email in question looks like a phishing attack from:

"Ryoko Wifi Router <Email address removed>"

So the domain is "" and there's a subdomain of nonsensical randomized characters "rpahcxialx".

The documentation from above says:

"Can I add custom subdomains or multiple domains to Microsoft 365?

Yes. To add subdomains, **you must manage your own DNS settings at your registrar's website**. If you are letting Microsoft manage your DNS settings with NS records, or if you bought the domain from Microsoft, **you can't add subdomains**."

Since "" is a Microsoft domain - I would assume that the Microsoft rule would apply "you can't add subdomains". This person/user is obviously not managing their own DNS or domain. But they have a subdomain of gibberish under a legit Microsoft domain making it look somewhat benign and they are using the service to spam people (at a minimum), but it looks more like a phishing attack. That's NOT good! I assume you understand the concept - bad, unreputable subdomains under your good, reputable domain is a terrible business practice.

So, what is going on? Why, or how, can someone use a legitimate domain from a major SaaS/Cloud vendor to spam, or much worse, attack other people? By using a subdomain from a legit domain makes this email looks harmless to most normal people. I don't know how dangerous this email is, if at all, and I'm not going to find out by clicking on anything. In the USA - we recently had 40% of the petrol to the east coast shut down by a ransomware attack and this is the primary method to gain access by criminals. I haven't done a full analysis of the header yet. I wanted to do a threat lookup of the domain first. I thought the domain name was a rather clever spoof of Microsoft, but whois says Microsoft owns the domain…! Well I'll be…

I'm scratching my head here on how a rogue subdomain can be launched under a legit "big-3" cloud provider domain…???!!!!

I have to say that I'm literally tired and warn out from patching all the holes and chasing down attacks to eliminate them before they can do damage. You guys need to do A LOT better! A 2 trillion dollar company should have the resources to make a huge difference, but… the issues just keep piling up… on us.

Any insight would be appreciated.


P.S. Steve Gibson, a real security expert, has some awesome and pointed critiques of the continued degradation of Windows security outcomes.


Aug 17th 2021
We invite you to read our show notes at

Aug 24th 2021
We invite you to read our show notes at

Sep 28th 2021

Live Shows

Transcripts and audio & video downloads:

@Jeff Milne 

I'm one of the victims of this.  I've just started receiving spam emails from someone using this domain.  I tried adding a rule to delete these emails but they keep appearing in my Junk Email.  Am I doing something wrong?

I'm also a victim of this, I'm inundated with thousands of these onmicrosoft accounts that appear to be phishing attacks. Filter rules don't work they are still getting through. It's so old.


Here's a sampling.... it's a constant barrage;

Email address removed