If we give trusts Azure AD access to read on premise AD, what happens when an on premise AD user has no email address?

Question

Can we access/authenticate with on premise AD user name (domain qualified sam-account names ex: cosmos\brahmi90) and password instead of using on email when azure active directory trusts to access read on premise active directory users?

What is UPN?

Answer 1

Your question is not very clear, but it looks like that you have some attributes that are not synchronized to Azure AD. The following documentation can help you to understand Azure AD connect and identify/ configure the attributes that can be synchronized:

https://docs.microsoft.com/en-us/azure/active-directory/connect/active-directory-aadconnect

https://docs.microsoft.com/en-us/azure/active-directory/connect/active-directory-aadconnectsync-whatis

https://docs.microsoft.com/en-us/azure/active-directory/connect/active-directory-aadconnectsync-attributes-synchronized

Answer 2

Can we access/authenticate with on premise AD user name (domain qualified sam-account names ex: cosmos\brahmi90) and password instead of using on email when azure active directory trusts to access read on premise active directory users?

If I understand properly, you want to use SAMAccountName to login the device.

1. If you have on-premise AD which have connected to Azure AD. You can use SAMAccountName and UPN to login.

2. If you don't have on-premise AD adn your device joined Azure AD through AD join, you can only use the UPN to login.

3. If you have join a domain which using Azure AD Domain Service, you can use both SAMAccountName and UPN to login.

What is UPN?

User principal name (UPN) format is used to specify an Internet-style name, such as [email protected]. The following table summarizes the parts of a UPN.

A UPN can be implicitly or explicitly defined. An implicit UPN is of the form [email protected]. An implicit UPN is always associated with the user's account, even if an explicit UPN is not defined. An explicit UPN is of the form Name@Suffix, where both the name and suffix strings are explicitly defined by the administrator.

See more details about UPN in this document.

If we give trusts Azure AD access to read on premise AD, what happens when an on premise AD user has no email address?

After syncing users from On-premise AD to Azure AD, each user will have a new UPN with .onmicrosoft.com in Azure AD. But you can also add your custom domain in Azure AD to change your UPN.