Authentication fails when email address and UPN do not match
By default, users authenticate using their email address when they use modern authentication. In most environments, the user’s email address and username in Azure AD are the same and authentication is successful. In hybrid environments, the username attribute in Azure is synchronized from the UPN value from Active Directory. This requires the users' email address and UPN values to match for authentication to be successful.
In some environments, users' email addresses and UPN values do not match. In this scenario, authentication will fail because the authentication token returned to the client from Azure is identified as being for the wrong user and is rejected.
The following client versions provide support for administrators to allow users to authenticate using the UPN instead of their email addresses:
- BlackBerry Work for iOSversion 2.19 or later
- BlackBerry Work for Androidversion 2.19 or later
- BlackBerry Notes for Androidversion 2.19 or later
- BlackBerry Notes for iOSversion 2.19 or later
- BlackBerry Tasks for Androidversion 2.19 or later
- BlackBerry Tasks for iOSversion 2.19 or later
- BlackBerry ConnectforAndroidversion 2.8.2 or later
- BlackBerry ConnectforiOSversion 2.8.2 or later
For instructions about how to configure
BEMS
to use an alternate email address to authenticate to BEMS-Docs
, see Enable the use of an alternate email address to authenticate to BEMS-Docs.If users are running earlier versions of the client in your environment, the user email addresses and UPN values match. If these values do not match, modern authentication will fail because the token being returned from
Azure
does not match the email address of the BlackBerry
Dynamics
app. Microsoft
recommends that the email address and UPN match. For more information, visit https://support.blackberry.com/community/s/article/50721 to read article 000050721.