I'm a Linux admin helping a small company move from an on-premises mail server to Azure and Exchange Online. Their AD domain ends in .lan, the domain controllers run Windows Server 2019, and the functional level is 2008.
I've hit sign-in trouble testing Entra Cloud Sync. Do we need to rename the AD domain, or is there a safer way to handle user identities?
You don't necessarily need to rename the AD domain. A common option is to verify a public domain the company controls in Entra ID, add it as an alternative UPN suffix in AD Domains and Trusts, then update the users' UPNs on premises.
That leaves the internal AD domain name alone while giving users a cloud sign-in name under a verified domain. Test with a small group first and check what depends on the old sign-in names. A UPN change is not the same thing as changing a mailbox address, so plan those separately.
I'd be cautious about treating a domain rename as a cleanup task. It affects the existing AD environment, not just cloud sign-in, and the functional level needs investigation too. Inventory dependencies and test any proposed change before deciding whether the benefit is worth the disruption.
Keeping .lan internally with a public UPN suffix may be less invasive. A new domain is another possibility, but that's a separate migration project, not a quick fix for Cloud Sync.
Get an AD and Exchange migration specialist involved before touching production. There are enough moving parts here that a review and a handover plan could save a lot of pain, especially if you're expected to maintain the result afterward.
Ask them to assess directory health, identity synchronization, the mail migration path, and rollback options. You can still do the ongoing administration without having to figure out every migration risk alone.
For the lab sign-in issue, separate the tenant admin account used to configure Cloud Sync from the UPNs you want synchronized users to have. Confirm which tenant you're signing into and which account the setup expects, then check that the custom domain is verified in that tenant.
The .lan suffix can't be verified as the company's public custom domain in Entra ID. If synchronized users have an unverified suffix, don't assume their cloud sign-in will match their mail address. Check the resulting UPNs in the test tenant before proceeding.
Answers are reviewed before publication.
try-the-roundabout-instead:
That's the approach I found in testing. I was unsure whether leaving .lan in place would cause enough trouble later to justify a full rename now.