This browser is no longer supported.
Upgrade to Microsoft Edge to take advantage of the latest features, security updates, and technical support.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(28.799999999999997, 15%, 12%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EMC%3C/text%3E%3C/svg%3E)
We have a local AD environment and it syncs only one way up to our Azure AD environment. I created a user account locally and used an extention attribute value "O365" which causes the record to be created in our Azure AD environment. This is the normal process and has worked fine for 1000+ user acounts. The problem I am experiencing is this new user account I created shows the username@colgov.onmicrosoft.com address as the Primary email address in their Azure AD record. It should be username@lynchburgva.gov, which is our local/network domain, the colgov.onmicrosoft.com should be an alias and this address has always been created automatically when the record is created and synced for the 1st time to Azure.
I cannot change this in the Azure record because it is synced to our local AD, there is a small print note at the top of the user record window displaying this:
"This user is synchronized with your local Active Directory. Some details can be edited only through your local Active Directory." But the local AD record shows only one email address, username@lynchburgva.gov, which is the proper value and format.
Do you know why this is occurring for only this user and how I can reconfigure the account so the primary email address is the one with our domain name?
I apprecate your help.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(9.6, 31%, 10%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EJX%3C/text%3E%3C/svg%3E)
Just checking in to see if above information was helpful. Please let us know if you would like further assistance.
If the question has been answered, please accept the helpful replies as answers, this will make answer searching in the forum easier and be beneficial to other community members as well.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(256, 39%, 34%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EZA%3C/text%3E%3C/svg%3E)
Go To active Directory >find the Users > go to Properties > attribute Editor > add the address to ProxyAddressess object Like SMTP:Zafir.ahmed@xyz.com and sync the active directory
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(278.4, 27%, 36%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3ENA%3C/text%3E%3C/svg%3E)
Did that, but it still shows the onmicrosoft.com email as primary. When I made the attribute sync directly in the Cloud Sync Attribute Mapping, Entra shows only the onmicrosoft.com email address in the proxy addresses field instead of both with the default settings, and the on site has the correct one in proxy addresses, only. When I change the On-site one, to anything, it does not change the online one. I believe this setting is not interacting with my user accounts as you expect. We are not running an Exchange server locally, only Domain Controllers and local network hosting services, DHCP DNS etc.. Email & Exchange server is all online and always has been.
I am running a couple of AD domains and MS Azure tenants, and the ones that do not run a local exchange server seems to suffer this issue. From what I can tell, it looks like my issue at least, may have something to do with the licensing and the Domain Settings in Office 365 Admin page. I found the same user account listed in both domains for all the user profiles having issues. The ones that don't, are only listed in the correct domain, and not in the onmicrosoft.com one.
If I delete a bad user account from the cloud, and make a change in the local domain suffix of the user account, it will re-added the user back into the cloud under the new domain. If I move it back to the correct Domain suffix and get all the changes done BEFORE applying the office 365 cloud license, it seems to keep everything straight. Once the license is applied to the user account, there is nothing I can do to change the online primary email away from the .onmicrosoft.com domain. I can even remove the license, but the cached mailbox settings are not removed with the license, and are reinstated with the license. Without the local Exchange server to interact with, the Hybrid setup seems to be partially dysfunctional when dealing with mailboxes tied to local domain user accounts. When I add a new user account, they randomly get added to the onmicrosoft.com account instead of the correct domain, even though the local domain controller uses the correct domain suffix every time. The local domain controller does not have the user settings to change the primary mailbox for exchange, and the online Exchange wont let you change it in order to keep in sync with the local AD. If the mailbox is created when the license is applied, it uses the cloud domain its attached to. Adding the attributes afterwards in the local AD DC just include the same user account on both domains in the cloud. I noticed adding the attributes before the license helps keep things straight when the license is added. Some accounts will still randomly jump to the onmicrosoft.com domain after the license has been applied for a few minutes when the mail, proxyaddresses, and userprincipalname are left default/undefined.
This has been a continuing issue now for almost 2 years for us. I have yet to talk to a Microsoft Tech that has a better solution beyond delete the account and recreate it properly. My clients love to hear they get to spend all day reconnecting and logging into all their accounts and services again. If we got to create every account from scratch ourselves, this would be okay knowing when to apply the license properly. Unfortunately, 8 out of 10 of our new clients have existing accounts and systems we get to take over and manage for them; full of pre-existing landmines we get to trip over.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(160, 12%, 25%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EA%3C/text%3E%3C/svg%3E)
For some reason for me if the proxyAddress had a capitalized "SMTP", they system would interpret that as the primary email address (and if there were multiple, the first capitalized address would be primary). Really confusing and frustrating, but when I changed all of the SMTP to smtp in the proxy addresses, it went back to normal.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(118.4, 64%, 21%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3ENA%3C/text%3E%3C/svg%3E)
The issue appears to be a dead-end configuration option in the Hybrid Environment. Microsoft does not have a way to edit the option in a local AD without a local Exchange server running in it. The Hybrid sync locks out the online ability to change the option and it does not exist in a local AD DC. The way they managed to config exchange in the hybrid environment; was to infer the settings you cannot access when the online exchange mailbox is created by looking at other fields in the user account from the local AD. My best guess so far is it is either the Proxy address field or the email address field in the user account attributes. If these are left to the defaults, blank, then when the user account is sync'd to the online servers, it's automatically assigned to the *.onmicrosoft.com domain in your tenant. My default domain is set to the public faced production domain we use, but that apparently does not apply to local user syncs, at least not yet. You can either move the user account to the correct domain online in the 365 Admin portal or set those user attribute fields in the local AD DC. Once the online user account is move to the correct domain, then assign the exchange license. The exchange server will create the mailbox with the correct domain as long as that part is fixed 1st.
To fix an existing issue, back up everything 1st, then back it up again like always. Then remove the Exchange or equivalent license from the user account. Once the license is removed, and the mailbox is gone, fix the user account so the domain is correct. Up to earlier this year, I was able to permanently delete the mailbox, Fix the user account attributes, then add a license back to the user account and the online exchange server would create a new mailbox for the user account with the correct domain. Now, it uses the old mailbox when its re-enabled, even after permanent removal. Now I have to completely delete the user account everywhere, wait an hour to make sure all the servers update, then create a new user account and make sure the attributes and domain are set before the license is added on. The only other way to fix the issue is to setup a local exchange server in your AD so you have the settings available to you locally. There are many issues with setting up a new local exchange server in an existing hybrid environment to overcome. Unless you have a few dozen user account to worry about, it may be easier to reset them individually and port the data back into the new account and mailboxes.
Good luck. I don't see Microsoft fixing this issue any time soon. Where the options are imbedded in the AD infrastructure, and how the hybrid environment engages the online config lockouts, makes it extremely difficult for Microsoft to isolate them. Most likely, we will have to wait for the next big server OS revision that is designed from the ground up for hybrid setup and configuration.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(6.4, 82%, 10%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EAG%3C/text%3E%3C/svg%3E)
Awesome comment, you made my day. I will do my best to avoid this mess in the imminent migration of my client.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(22.400000000000002, 13%, 12%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EAP%3C/text%3E%3C/svg%3E)
Ensure the proxyAddresses attribute is filled out with SMTP:username@domain.com.
Do you see the desired address at all in Exchange Online? Is it assigned to the same user or a different one? Easiest way to check is via the Get-Recipient cmdlet:
Get-Recipient user@domain.com
Depending on the result, you either have to remove the alias for any additional objects returned by the above query, or simply to set it as primary one. Strongly recommended to perform this operation on-premises. Back in the day, there was a workaround that enabled you to change the PrimarySMTPAddress directly in the cloud, but this is not a supported solution (and no longer works):
Set-Mailbox user@domain.onmicrosoft.com -WindowsEmailAddress user@domain.com