Skip to content
Bpanda
Esc
↑↓navigate↵open⌘Jpreview
On this page

Also Recognize Users by Their E-Mail Address

So that users continue to be synchronized with Bpanda after a change to the User Principal Name in Microsoft Entra ID, for example after a name change or a domain switch: set up the e-mail address in provisioning as a second matching attribute (matching precedence).

Microsoft Entra ID recognizes a user in Bpanda by their user name, the User Principal Name from your tenant. Bpanda cannot change this user name afterwards. If the User Principal Name changes, Entra ID no longer finds the user during the next full synchronization. With the e-mail address as a second matching attribute, it finds them anyway.

When You Need This

You need this setting if the User Principal Name of users can change in your tenant, for example:

  • A user gets a new last name after getting married, and with it both the User Principal Name and the e-mail address change.
  • Your company switches its domain, and as a result the User Principal Name and the e-mail address of all users change.

Bpanda adopts the new e-mail address during ongoing operation, but not the new User Principal Name. During the next full synchronization, Entra ID looks for the user under the new User Principal Name, does not find them and tries to create them anew. This fails because their e-mail address is already taken in Bpanda, and the user is no longer synchronized. With the e-mail address as a second matching attribute, Entra ID continues its search there and finds the existing user.

Important: Every e-mail address must be unique in your tenant.

Prerequisites

You are allowed to edit the provisioning of the Bpanda Enterprise App in Entra ID, as a Global Administrator or Application Administrator.

How to Proceed

  1. In Entra ID, open your Bpanda Enterprise App and go to Provisioning under Manage.

  2. Click Edit provisioning.

  3. Expand Mappings and open Provision Microsoft Entra ID Users.

  4. In the table of attributes, click Edit in the row emails[type eq "work"].value (Entra attribute mail).

  5. In the Edit Attribute dialog, change these two values and confirm with Ok:

    Field Value
    Match objects using this attribute Yes
    Matching precedence 2

  6. Click Save. The confirmation prompt informs you that all assigned users and groups will then be synchronized anew. Confirm with Yes.

Afterwards, the Matching precedence column shows a 1 for userName and a 2 for emails[type eq "work"].value.

Important: Saving starts a full synchronization, not the usual cycle. Depending on the size of your directory, it takes correspondingly long.

Microsoft describes more about matching attributes in Customizing attribute mappings. If you need support, get in touch with us.

See also: Setting Up Microsoft Entra ID, Checking User Synchronization with Entra ID

Was this page helpful?