When trying to change the default UPN suffix by changing or adding a provisioning policy with the new suffix and creating new user accounts, the new suffix does not appear as the default. Restarting the MMC does not help.
There is still a UPN suffix listed in the Alternative UPN suffixes of the properties in Active Directory Domains and Trusts which is still appearing in ActiveRoles Server.
Open Active Directory Domains and Trusts
Right-click on the top most level of Active Directory Domains and Trusts and select Properties
A dialog box should appear with UPN Suffixes and allow you to add or remove Alternative UPN suffixes
Please make sure that the suffix you do not want is not listed there. If there are any unwanted Suffixes listed, remove them and click Ok