In the Microsoft ecosystem, the UserPrincipalName is more than just a display label. It acts as the unique sign-in identity used across Entra ID, Teams, SharePoint, Exchange Online, and even Windows devices joined to Azure AD. Changing a UPN incorrectly, or in the wrong environment, can silently disrupt user sign-ins and connected services for hours before the issue is noticed. This guide covers how to change a user’s UPN in Microsoft 365 cloud-only and hybrid environments.
Why is a UPN and Why Does it Matter
The UserPrincipalName is structured as prefix@domain.com. The prefix is the username portion, and the domain suffix must be a verified domain registered to your Microsoft 365 tenant. It looks like an email address, and in most organizations it matches the primary email address, but it does not have to. Understanding the difference is important:
- The UPN is used for sign-in to Microsoft 365, Entra ID, PowerShell sessions, and Azure AD-joined devices.
- The primary SMTP address is used for mail delivery and calendar invites.
- Changing one does not automatically change the other. Both may need to be updated independently.
When you change a UPN, you are changing the credential the user types to log in. Every token, cached session, and application registration that relies on that credential will be affected. That is why a UPN change is considered a breaking change and must be planned carefully.
Prerequisites Before Updating a UPN in Microsoft 365
Before changing any UPNs, go through the checks below. Most sign-in issues, sync problems, and rollback headaches happen because one of these steps was skipped.
Verify the domain in Microsoft 365: Open the Microsoft 365 Admin Center → Settings → Domains. Make sure the new domain is already added and verified. If the domain is missing or unverified, Microsoft 365 will not allow the UPN change.
Add the UPN suffix in on-premises AD (Hybrid only): If you are in a Hybrid environment, the new domain must be added to your local forest. Open AD Domains and Trusts, right-click the root, select Properties, and add the new suffix.
Check administrator permissions: You need Global Administrator or User Administrator permissions in Microsoft 365, and Account Operator or Domain Admin rights in local AD.
Export the current user list: Before any bulk change, export the current UPN list from Entra ID or AD. This gives you a rollback reference if something goes wrong and serves as an audit record of what existed before the migration.
Communicate to affected users in advance: Tell users their new UPN before you make the change. Explain that they will be signed out of all sessions, that they must use the new UPN to log back in, and that they may be prompted to re-register MFA. Failure to communicate this in advance generates unnecessary helpdesk tickets and user panic.
Schedule during low-activity hours: UPN changes immediately invalidate active sessions. Schedule bulk changes outside core working hours to minimize disruption.
How to Change UPN in Microsoft 365 For Cloud-Only Users
Cloud-only users exist entirely within Entra ID and have no on-premises AD counterpart. There is no sync cycle to worry about. Changes made in the Admin Center or via PowerShell take effect immediately, but the user will be signed out of all active sessions and must re-authenticate with the new UPN straight away.
Method 1: Using the Microsoft 365 Admin Center
Best for small businesses or organizations without a local server.
- Navigate to the Microsoft 365 Admin Center.
- Go to Users > Active users.
- Click the display name of the user you want to edit.
- In the fly-out pane, locate the Account tab and click Manage username and email.
- Under the Primary email address and username section, click the Edit icon.
- Type the new prefix and select the correct domain from the dropdown menu.
- Click Done and then Save changes.
Method 2: Using the Microsoft Entra Admin Center
The Entra Admin Center provides a more identity-focused administrative experience. Administrators already working within Entra ID often prefer this approach because it keeps identity operations centralized.
- Sign in to the Microsoft Entra admin center.
- Go to Identity > Users > All users.
- Click on the user’s display name, then select Edit properties.
- Locate the User principal name field, update the prefix or domain, and click Save.
While both admin centers are suitable for occasional user modifications, it still requires multiple manual steps for each update and becomes inefficient during bulk operations.
Method 3: Using the PowerShell
PowerShell is the preferred method for IT professionals because it pushes the change directly through the Microsoft Graph API, produces a consistent result, and is repeatable for bulk operations.
# Authenticate with the required scope
Connect-MgGraph -Scopes 'User.ReadWrite.All'
# Update the UPN
Update-MgUser -UserId 'jane.smith@contoso.com' `
-UserPrincipalName 'jane.smith@fabrikam.com'
# Verify immediately. Never assume the change worked.
Get-MgUser -UserId 'jane.smith@fabrikam.com' `
| Select-Object UserPrincipalName, Mail, DisplayNameThis approach requires familiarity with Microsoft Graph PowerShell modules, authentication scopes, and scripting practices. A single incorrect command can affect multiple users rapidly, which increases operational risk if proper validation is not performed beforehand.
How to Change UserPrincipalName (UPN) for Hybrid Microsoft 365 Users
For users synced from a local Active Directory (AD) via Entra Connect, the change must happen on-premises.
Add UPN Suffix: Ensure the new domain is added as a suffix in AD Domains and Trusts.
Update AD Object: In AD Users and Computers, change the User logon name under the user’s Account tab.
Force Sync: Run Start-ADSyncSyncCycle -PolicyType Delta on your sync server to push the change to the cloud immediately.
Verification: If the change does not reflect in the cloud, ensure the SynchronizeUpnForManagedUsers feature is enabled for your tenant
The Easiest Way to Change a User UPN: EasyEntra
EasyEntra allows you to update a user’s UPN directly from the user properties panel without opening the Microsoft 365 Admin Center or running PowerShell. This is the fastest route for one-off changes when you are already working inside EasyEntra.
- Open EasyEntra and navigate to the Users section from the main navigation panel.
- Use the search bar to locate the user by name, current UPN, or display name. Click the user to open their profile.
- Inside the user profile, navigate to the Account tab. and enter the new UPN value. Make sure the domain suffix you are entering is already verified in your Microsoft 365 tenant. Unverified domains will not be accepted.
- Click Apply. The change is submitted to Entra ID via the Microsoft Graph API and takes effect immediately for cloud-only users.
The General tab can also be used to manage the user’s email-related attributes separately. This distinction is important because the UserPrincipalName and the primary email address are not the same attribute in Microsoft 365. The UPN controls how users sign in to Microsoft services, while the primary email address controls how mail is delivered through Exchange Online.
Although both values are often configured identically in many organizations, changing the email address does not automatically modify the UserPrincipalName, and changing the UPN does not automatically update the mailbox email address.
EasyEntra supports both cloud-only and hybrid Active Directory user UPN changes, helping administrators manage identities from a single interface without switching between multiple tools.
With the right planning and validation, changing a UPN in Microsoft 365 can be completed smoothly with minimal disruption to users.
