We help IT Professionals succeed at work.

Should userPrincipalName in Active Directory match external email domain or the internal AD domain

Last Modified: 2018-09-14
I've got an active directory domain (2008 level) which predates our email moving to Exchange, so the domain names are different. The AD one is a ".local" created in the days before the best practice was to match external domain names. This means that email addresses (using our external domain) differ from internal identifiers. We now have an on-premise Exchange 2016 server. I've implemented autodiscover which was fine before Outlook 2016 came along as we could always specify the domain name in setting up. Now with Outlook 2016 the option to set this are so hard to discover that I decided to find out why I couldn't login to Outlook with just the external facing email address. It seems to work with setting up Outlook inside the domain, but I've got some external email users who don't have this option.

After much investigation, I found that the AD field userPrincipalName is set to user@internal.local instead of user@external.com and that this governs whether you can login with the external email address on OWA. Here's the link that gave me the clue: https://social.technet.microsoft.com/Forums/en-US/15eef306-69b5-4008-904e-50e0116c223f/setup-outlook-anywhere-to-not-ask-for-domainusername-just-email-address-only?forum=exchange2010

So if I reset the field in the user's record in AD to the external email domain, I can then login with just the email address, and set up new Outlook 2016 profiles again with just the email address. So far this seems to work.

The question is whether this is good practice, or whether I should change my AD to use the external domain name, or some combination perhaps involving having both internal and external domains defined. Are there any gotchas if I simply change the userPrincipalName to match the email address in all cases?

I'm intending to migrate some of our mailboxes to Office 365 in the next month or two, so it would be good if there's a best practice to make this migration easier.
Watch Question

timgreen7077Exchange Engineer
Distinguished Expert 2018

No the the UPN doesn't need to match the external email address domain. They can be completely different, but it does make it easier to deal with at times. Also if you plan on setting up a hybrid environment in order to migrate to o365, you will need to remove the .local from the proxy email addresses on the user mailboxes. O365 doesn't allow the .local suffix. You don't have to remove .local from your domain but it can't be a proxy address on the mailbox.
Exchange Engineer
Distinguished Expert 2018
This problem has been solved!
(Unlock this solution with a 7-day Free Trial)
Ian GoodingTechnical Services Manager


Thanks, that's just what I needed to give me confidence. I'm trying it out with a few users and will then build a script to update everyone else.
timgreen7077Exchange Engineer
Distinguished Expert 2018

I would always use test accounts first before making any changes to production users, but you should be good.
Ian GoodingTechnical Services Manager


So would I! I tried it first with a test account, which connects fine with OWA and mobile Outlook, so have changed my own AD profile. As I'm probably the most complex user setup this ought to reveal any hidden side effects...

Gain unlimited access to on-demand training courses with an Experts Exchange subscription.

Get Access
Why Experts Exchange?

Experts Exchange always has the answer, or at the least points me in the correct direction! It is like having another employee that is extremely experienced.

Jim Murphy
Programmer at Smart IT Solutions

When asked, what has been your best career decision?

Deciding to stick with EE.

Mohamed Asif
Technical Department Head

Being involved with EE helped me to grow personally and professionally.

Carl Webster
CTP, Sr Infrastructure Consultant
Empower Your Career
Did You Know?

We've partnered with two important charities to provide clean water and computer science education to those who need it most. READ MORE

Ask ANY Question

Connect with Certified Experts to gain insight and support on specific technology challenges including:

  • Troubleshooting
  • Research
  • Professional Opinions