Question

Contoso is deploying Microsoft Entra Connect to synchronize its on-premises Active Directory to a new Entra tenant. The internal AD forest uses the non-routable domain suffix contoso.local, and all user UPNs currently end in @contoso.local. The verified domain in the Entra tenant is contoso.com. Users report they cannot sign in to Microsoft 365 with their on-premises credentials after the initial sync. What should you do to resolve the sign-in problem while ensuring users retain a consistent sign-in name?

Accepted Answer

Add contoso.com as an alternative UPN suffix in Active Directory Domains and Trusts, update each user's UPN to use @contoso.com, and run a delta sync.

Answer

Verify contoso.local as a custom domain in the Entra tenant so the synchronized UPNs match a verified domain.

Answer

Disable directory synchronization and create the users as cloud-only accounts with @contoso.com UPNs.

Answer

Configure the Entra Connect source anchor to use the mail attribute instead of objectGUID so sign-in uses the correct domain.