The new domain is verified in Microsoft 365, mail DNS records are in place, and the UPN suffix has been added to AD. User accounts sync from AD.
I'm planning to change each user's UPN and primary email address, keep the old email address as an alias, then update group addresses. What else should I check?
That sequence is a reasonable starting point. The UPN and primary email address are separate changes, so check both after the sync rather than assuming one changed the other.
For each user, set the new UPN in AD. In proxyAddresses, use uppercase SMTP: for the new primary address and lowercase smtp: for the old address you want to retain. Make sure there's only one uppercase SMTP: entry, and preserve any other aliases that are still needed.
Sync and verify a small group first. Check the UPN and addresses in Microsoft 365, then test mail delivery to both domains before changing sign-in instructions for everyone.
Look beyond user mailboxes before calling it done. Shared and resource mailboxes, distribution groups, mail-enabled security groups, Teams or SIP addresses, and devices such as scanners or relays may still use the old domain.
I'd inventory those separately and test them as they change. Also check that DKIM is enabled for the new domain, not just that the DNS records exist.
Check applications that use Entra for SAML or OIDC sign-in. Anything that identifies a user by the old UPN could need attention when that value changes. If you don't have those integrations, that's one less thing to worry about.
Plan for users to sign out and back in with the new UPN, and include Teams and OneDrive in the pilot checks.
Keep an eye on the sync itself. You can run a sync from the Entra Connect server and check its logs if an attribute doesn't show up as expected. Confirm the cloud values before telling users to switch sign-in names.
One extra troubleshooting detail: check mailNickname if Teams presence acts strange after the change. It's an AD attribute worth including in the checks, though presence problems can have other causes too.
Answers are reviewed before publication.
7q~fusecase_314:
Keeping the old address as a mail alias doesn't by itself establish that it will work as a sign-in name. Check the sign-in configuration separately.