Question regarding UPN and AD pass through

%3CLINGO-SUB%20id%3D%22lingo-sub-289956%22%20slang%3D%22en-US%22%3EQuestion%20regarding%20UPN%20and%20AD%20pass%20through%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-289956%22%20slang%3D%22en-US%22%3E%3CP%3EHello%20and%20pardon%20the%20question%20if%20I%20missed%20the%20answer%20elsewhere.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EWe%20are%20finally%20migrating%20off%20on%20prem%20to%20O365.%20I%20would%20like%20to%20use%20pass%20through%20authentication%20but%20have%20questions%20about%20the%20UPN%2C%20public%20versus%20private%20domain.%20Let's%20say%20for%20example%20our%20public%20domain%20name%20for%20email%20is%20public.com%20and%20the%20internal%20AD%20domain%20is%20private.com%20AND%20we%20own%20both%20domain%20names.%20Our%20users%20email%20addresses%20are%20similar%20to%26nbsp%3Bname%40public.com%20and%20the%20internal%20UPN%20is%20user%40private.com.%20When%20setting%20up%20authentication%20since%20we%20own%20private.com%20and%20it%20is%20routable%20can%20we%20continue%20to%20use%20that%20for%20our%20user%20UPN%20or%20do%20we%20have%20to%20change%20it%20to%20user%40public.com%3F%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EIf%20we%20can%20continue%20to%20have%20users%20log%20in%20as%20user%40private.com%20I%20have%20to%20add%20that%20private%20domain%20name%20to%20the%20domain%20list%20in%20O365%20admin%20center%2C%20yes%3F%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EFinally%2C%20I%20got%20some%20confusing%20information%20form%20the%20tech%20who%20will%20be%26nbsp%3Bassisting%20us%20in%20the%20migration.%20He%20stated%20that%20he%20thought%20we%20have%20to%20maintain%20an%20exchange%20server%20on%20prem%20is%20we%20intend%20to%20ADFS%20or%20use%20pass%20though%20authentication%20-%20this%20is%20not%20correct%20is%20it%3F%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EThank%20you%3C%2FP%3E%3CP%3EMichael%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-LABS%20id%3D%22lingo-labs-289956%22%20slang%3D%22en-US%22%3E%3CLINGO-LABEL%3EOffice%20365%3C%2FLINGO-LABEL%3E%3C%2FLINGO-LABS%3E%3CLINGO-SUB%20id%3D%22lingo-sub-291869%22%20slang%3D%22en-US%22%3ERe%3A%20Question%20regarding%20UPN%20and%20AD%20pass%20through%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-291869%22%20slang%3D%22en-US%22%3E%3CP%3EOK.%20We%20are%20maintaining%20an%20on%20prem%20AD%20environment%20so%20should%20have%20more%20than%20enough%20Windows%20Server%26nbsp%3BCALs%20for%20that%20purpose.%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EThank%20you%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-291864%22%20slang%3D%22en-US%22%3ERe%3A%20Question%20regarding%20UPN%20and%20AD%20pass%20through%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-291864%22%20slang%3D%22en-US%22%3ENow%20keep%20in%20mind%20that's%20in%20regards%20to%20Exchange%2C%20you%20still%20need%20Windows%20Server%20Cal's%20for%20users%20if%20they%20still%20authenticate%20on-prem%20in%20any%20way.%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-291859%22%20slang%3D%22en-US%22%3ERe%3A%20Question%20regarding%20UPN%20and%20AD%20pass%20through%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-291859%22%20slang%3D%22en-US%22%3E%3CP%3EExcellent!%20That's%20what%20I%20was%20just%20trying%20to%20look%20up.%20I%20got%20very%20confusing%20info%20about%20that%20from%20the%20tech%20were%20are%20using%20to%20assist.%3C%2FP%3E%3CP%3EThank%20you%20very%20much%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-291855%22%20slang%3D%22en-US%22%3ERe%3A%20Question%20regarding%20UPN%20and%20AD%20pass%20through%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-291855%22%20slang%3D%22en-US%22%3EYou%20shouldn't%20need%20CAL's%20if%20you%20don't%20host%20mailboxes%2C%20the%20only%20thing%20you%20need%20licensed%20on%20prem%20is%20the%20server%20software%20itself.%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-291852%22%20slang%3D%22en-US%22%3ERe%3A%20Question%20regarding%20UPN%20and%20AD%20pass%20through%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-291852%22%20slang%3D%22en-US%22%3E%3CP%3EWe're%20licensed%20for%20Business%20Essentials%2C%20not%20E3%20or%20better%2C%20so%20I%20don't%20think%20I%20can%20use%20the%20free%20key.%20I%20have%20an%20entitlement%20to%20on%20prem%20Exchange%202016%20though%2C%20but%20not%20enough%20CALs%20for%20every%20user%20at%20that%20level.%20I'll%20have%20to%20investigate%20my%20options%20further.%20It%20may%20wind%20up%20we%20elevate%20to%20E3.%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-290065%22%20slang%3D%22en-US%22%3ERe%3A%20Question%20regarding%20UPN%20and%20AD%20pass%20through%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-290065%22%20slang%3D%22en-US%22%3EAfter%20migration%20you%20could.%20Check%20out%20hybrid%20license%20thou%20cause%20the%20server%20still%20needs%20a%20license.%20It%E2%80%99s%20free%2C%20if%20you%20already%20have%20an%20exchange%20license%20thou%20you%20can%20still%20use%20that%20but%20eventually%20you%E2%80%99ll%20want%20to%20change.%20But%20your%20right%20no%20cals%20needed%20if%20moved%20to%20cloud%20and%20used%20for%20management%20only.%20Just%20server%20license%20being%20what%20you%20had%20or%20new%20server%20with%20hybrid.%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-290061%22%20slang%3D%22en-US%22%3ERe%3A%20Question%20regarding%20UPN%20and%20AD%20pass%20through%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-290061%22%20slang%3D%22en-US%22%3E%3CP%3ESecond%20question%20re.%20your%20reply%20-%20keeping%20an%20exchange%20server%20on%20prem%2C%20it's%20just%20acting%20as%20a%20management%20console%20basically%20since%20non%20of%20the%20mail%20data%20is%20stored%20locally%20nor%20does%20it%20pass%20through%20that%20server%2C%20correct%3F%20So%20I%20could%20set%20up%20a%20tiny%20VM%20with%20just%20Exchange%20whatever%20version%20installed%20and%20not%20have%20to%20worry%20about%20space%20for%20the%20data%2C%20nor%20CALs%20since%20the%20client%20licenses%20are%20now%20O365%3F%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-290039%22%20slang%3D%22en-US%22%3ERe%3A%20Question%20regarding%20UPN%20and%20AD%20pass%20through%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-290039%22%20slang%3D%22en-US%22%3E%3CP%3EChris%2C%20thanks%20for%20your%20reply%2C%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EI%20think%20I%20found%20an%20article%20I%20was%20looking%20for.%20I%20skimmed%20this%20a%20couple%20weeks%20ago%20and%20then%20couldn't%20remember%20where%20I%20saw%20it.%20So%20yeah%2C%20should%20be%20OK%20based%20on%20this%2C%20I'll%20just%20have%20to%20add%20my%20private%20AD%20domain%20name%20to%20the%20list.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%22Azure%20AD%20Connect%20synchronizes%20your%20users'%20UPN%20and%20password%20so%20that%20users%20can%20sign%20in%20with%20the%20same%20credentials%20they%20use%20on-premises.%20However%2C%20Azure%20AD%20Connect%20only%20synchronizes%20users%20to%20domains%20that%20are%20verified%20by%20Office%20365.%20This%20means%20that%20the%20domain%20also%20is%20verified%20by%20Azure%20Active%20Directory%20because%20Office%20365%20identities%20are%20managed%20by%20Azure%20Active%20Directory.%20In%20other%20words%2C%20the%20domain%20has%20to%20be%20a%20valid%20Internet%20domain%20(for%20example%2C%20.com%2C%20.org%2C%20.net%2C%20.us%2C%20etc.).%20If%20your%20internal%20Active%20Directory%20only%20uses%20a%20non-routable%20domain%20(for%20example%2C%20.local)%2C%20this%20can't%20possibly%20match%20the%20verified%20domain%20you%20have%20on%20Office%20365.%20You%20can%20fix%20this%20issue%20by%20either%20changing%20your%20primary%20domain%20in%20your%20on%20premises%20Active%20Directory%2C%20or%20by%20adding%20one%20or%20more%20UPN%20suffixes.%22%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-290018%22%20slang%3D%22en-US%22%3ERe%3A%20Question%20regarding%20UPN%20and%20AD%20pass%20through%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-290018%22%20slang%3D%22en-US%22%3E%3CP%3EJuan%20Carlos%2C%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EIn%20an%20example%20I%20saw%2C%20the%20scenario%20was%20the%20organization%20had%20domain.com%20as%20their%20public%20domain%20and%20domain.local%20as%20their%20private%20AD%20domain.%20Obviously%20you%20cannot%20use%20a%20dot%20local%20domain%20outside%20your%20private%20AD%20environment.%20We%20on%20the%20other%20hand%20use%20public.com%20for%20email%20and%20private.com%20from%20AD%20and%20we%20own%20both%20domains.%20So%20my%20thought%20was%20that%20since%20I%20own%20it%20couldn't%20I%20just%20use%20private.com%20for%20O365%20login%3F%20That%20is%20to%20say%20my%20users%20could%20still%20log%20in%20as%20user%40private.com%20(on%20premises%20UPN)%20instead%20of%20user%40public.com%20(Alternate%20ID)%20and%20only%20use%20the%20%40public.com%20domain%20name%20for%20their%20email%20account%20e.g.%20person%40public.com%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-290008%22%20slang%3D%22en-US%22%3ERe%3A%20Question%20regarding%20UPN%20and%20AD%20pass%20through%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-290008%22%20slang%3D%22en-US%22%3ENot%20sure%20if%20I%20follow%20you%20here...the%20UPN%20used%20to%20login%20in%20Office%20365%20should%20be%20based%20on%20a%20public%20domain%20and%20normally%20what%20you%20do%20is%20sync%20this%20UPN%20from%20your%20local%20AD%20to%20Office%20365%20in%20one%20of%20the%20account%20atributes%20(Mail%20one)%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-290006%22%20slang%3D%22en-US%22%3ERe%3A%20Question%20regarding%20UPN%20and%20AD%20pass%20through%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-290006%22%20slang%3D%22en-US%22%3EYes%20you%20can%20use%20the%20UPN%20as%20it%20will%20carry%20over%20when%20syncing%20along%20with%20your%20primary%20e-mail%20and%20it%20needs%20to%20be%20added%20as%20a%20domain%20to%20the%20tenant.%20You%20can%20use%20Passthrough%20without%20exchange%20onprem%20but%20i%20would%20recommend%20keeping%20one%20as%20it%20makes%20administration%20easier.%20Many%20others%20have%20removed%20their%20exchange%20servers%20and%20do%20their%20admin%20through%20AD%20attributes%20so%20it's%20optional.%20Until%20you%20plan%20to%20completely%20remove%20AD%20sync%20and%20stand%20alone%20in%20365%20in%20the%20future%20I%20would%20say%20keep%20it%20around.%3C%2FLINGO-BODY%3E
Highlighted
Occasional Contributor

Hello and pardon the question if I missed the answer elsewhere.

 

We are finally migrating off on prem to O365. I would like to use pass through authentication but have questions about the UPN, public versus private domain. Let's say for example our public domain name for email is public.com and the internal AD domain is private.com AND we own both domain names. Our users email addresses are similar to name@public.com and the internal UPN is user@private.com. When setting up authentication since we own private.com and it is routable can we continue to use that for our user UPN or do we have to change it to user@public.com?

 

If we can continue to have users log in as user@private.com I have to add that private domain name to the domain list in O365 admin center, yes?

 

Finally, I got some confusing information form the tech who will be assisting us in the migration. He stated that he thought we have to maintain an exchange server on prem is we intend to ADFS or use pass though authentication - this is not correct is it?

 

Thank you

Michael

11 Replies
Highlighted
Yes you can use the UPN as it will carry over when syncing along with your primary e-mail and it needs to be added as a domain to the tenant. You can use Passthrough without exchange onprem but i would recommend keeping one as it makes administration easier. Many others have removed their exchange servers and do their admin through AD attributes so it's optional. Until you plan to completely remove AD sync and stand alone in 365 in the future I would say keep it around.
Highlighted
Not sure if I follow you here...the UPN used to login in Office 365 should be based on a public domain and normally what you do is sync this UPN from your local AD to Office 365 in one of the account atributes (Mail one)
Highlighted

Juan Carlos,

 

In an example I saw, the scenario was the organization had domain.com as their public domain and domain.local as their private AD domain. Obviously you cannot use a dot local domain outside your private AD environment. We on the other hand use public.com for email and private.com from AD and we own both domains. So my thought was that since I own it couldn't I just use private.com for O365 login? That is to say my users could still log in as user@private.com (on premises UPN) instead of user@public.com (Alternate ID) and only use the @public.com domain name for their email account e.g. person@public.com

Highlighted

Chris, thanks for your reply,

 

I think I found an article I was looking for. I skimmed this a couple weeks ago and then couldn't remember where I saw it. So yeah, should be OK based on this, I'll just have to add my private AD domain name to the list.

 

"Azure AD Connect synchronizes your users' UPN and password so that users can sign in with the same credentials they use on-premises. However, Azure AD Connect only synchronizes users to domains that are verified by Office 365. This means that the domain also is verified by Azure Active Directory because Office 365 identities are managed by Azure Active Directory. In other words, the domain has to be a valid Internet domain (for example, .com, .org, .net, .us, etc.). If your internal Active Directory only uses a non-routable domain (for example, .local), this can't possibly match the verified domain you have on Office 365. You can fix this issue by either changing your primary domain in your on premises Active Directory, or by adding one or more UPN suffixes."

Highlighted

Second question re. your reply - keeping an exchange server on prem, it's just acting as a management console basically since non of the mail data is stored locally nor does it pass through that server, correct? So I could set up a tiny VM with just Exchange whatever version installed and not have to worry about space for the data, nor CALs since the client licenses are now O365?

Highlighted
After migration you could. Check out hybrid license thou cause the server still needs a license. It’s free, if you already have an exchange license thou you can still use that but eventually you’ll want to change. But your right no cals needed if moved to cloud and used for management only. Just server license being what you had or new server with hybrid.
Highlighted

We're licensed for Business Essentials, not E3 or better, so I don't think I can use the free key. I have an entitlement to on prem Exchange 2016 though, but not enough CALs for every user at that level. I'll have to investigate my options further. It may wind up we elevate to E3.

Highlighted
You shouldn't need CAL's if you don't host mailboxes, the only thing you need licensed on prem is the server software itself.
Highlighted

Excellent! That's what I was just trying to look up. I got very confusing info about that from the tech were are using to assist.

Thank you very much

Highlighted
Now keep in mind that's in regards to Exchange, you still need Windows Server Cal's for users if they still authenticate on-prem in any way.
Highlighted

OK. We are maintaining an on prem AD environment so should have more than enough Windows Server CALs for that purpose. 

 

Thank you