It is not possible in the Active Roles Console or Active Roles Web Interface to purposefully set a mismatched UPN Suffix (4379112)

Although it is possible in Active Directory Users and Computers and the Active Roles Management Shell, it is not possible in the Active Roles Console or the Active Roles Web Interface to purposefully make a User have a mismatched UPN Suffix.

In certain scenarios, this may be desired as a means of preventing an account from logging in.

This is expected Active Roles functionality. The Active Roles Console and the Active Roles Web Interface have hard-coded functionality which prevent setting a mismatched UPN Suffix via the standard interface.

WORKAROUND 1

Use the Active Roles Management Shell or Active Directory Users and Computers to set a mismatched UPN Suffix

WORKAROUND 2

Write the desired UPN Suffix to an Active Roles Virtual Attribute and then leverage a Script Module or a Change Workflow to update the userPrincipalName using a constructed value.

STATUS

An Enhancement Request has been created to change functionality in Active Roles.

Product Management will evaluate the request and this feature may become available in a future release of the product.

There are no guarantees that this specific enhancement request will be implemented in a future release.

For more information regarding our Enhancement Request policy, refer to our Global Support Guide on the Support Portal at: https://support.oneidentity.com/essentials/support-guide/