Azure AD UserPrincipalName 填充Azure AD UserPrincipalName population

本文介绍如何在 Azure Active Directory (Azure AD) 中填充 UserPrincipalName 属性。This article describes how the UserPrincipalName attribute is populated in Azure Active Directory (Azure AD). UserPrincipalName 属性值是用户帐户的 Azure AD 用户名。The UserPrincipalName attribute value is the Azure AD username for the user accounts.

UPN 术语UPN terminology

本文使用了以下术语:The following terminology is used in this article:

术语Term 说明Description
初始域Initial domain Azure AD 租户中的默认域 (partner.onmschina.cn)。The default domain (partner.onmschina.cn) in the Azure AD Tenant. 例如 contoso.partner.onmschina.cn。For example, contoso.partner.onmschina.cn.
Microsoft 联机电子邮件路由地址 (MOERA)Microsoft Online Email Routing Address (MOERA) Azure AD 基于 Azure AD MailNickName 属性和 <MailNickName>@<初始域> 形式的 Azure AD 初始域计算 MOERA。Azure AD calculates the MOERA from Azure AD MailNickName attribute and Azure AD initial domain as <MailNickName>@<initial domain>.
本地 mailNickName 属性On-premises mailNickName attribute Active Directory 中的一个属性,其值表示 Exchange 组织中某个用户的别名。An attribute in Active Directory, the value of which represents the alias of a user in an Exchange organization.
本地 mail 属性On-premises mail attribute Active Directory 中的一个属性,其值表示某个用户的电子邮件地址An attribute in Active Directory, the value of which represents the email address of a user
主要 SMTP 地址Primary SMTP Address Exchange 收件人对象的主要电子邮件地址。The primary email address of an Exchange recipient object. 例如 SMTP:user@contoso.com。For example, SMTP:user@contoso.com.
备用登录 IDAlternate login ID 除 UserPrincipalName 以外的本地属性,例如 mail 属性,用于登录。An on-premises attribute other than UserPrincipalName, such as mail attribute, used for sign-in.

什么是 UserPrincipalName?What is UserPrincipalName?

UserPrincipalName 是基于 Internet 标准 RFC 822 的属性,表示某个用户的 Internet 样式登录名。UserPrincipalName is an attribute that is an Internet-style login name for a user based on the Internet standard RFC 822.

UPN 格式UPN format

UPN 由 UPN 前缀(用户帐户名)和 UPN 后缀(DNS 域名)组成。A UPN consists of a UPN prefix (the user account name) and a UPN suffix (a DNS domain name). 前缀与后缀以“@”符号相联接。The prefix is joined with the suffix using the "@" symbol. 例如“someone@example.com”。For example, "someone@example.com". UPN 必须在目录林中的所有安全主体对象之间保持唯一。A UPN must be unique among all security principal objects within a directory forest.

Azure AD 中的 UPNUPN in Azure AD

Azure AD 使用 UPN 让用户登录。The UPN is used by Azure AD to allow users to sign-in. 用户可以使用的 UPN 取决于域是否经过验证。The UPN that a user can use, depends on whether or not the domain has been verified. 如果域已验证,则允许具有该后缀的用户名登录到 Azure AD。If the domain has been verified, then a user with that suffix will be allowed to sign-in to Azure AD.

该属性由 Azure AD Connect 同步。The attribute is synchronized by Azure AD Connect. 在安装期间,可以查看已验证和未验证的域。During installation, you can view the domains that have been verified and the ones that have not.

未验证的域

备用登录 IDAlternate login ID

在一些环境中,最终用户可能仅知道自己的电子邮件地址,但不知道自己的 UPN。In some environments, end users may only be aware of their email address and not their UPN. 使用电子邮件地址的原因可能是公司策略或本地业务线应用程序依赖项。The use of email address may be due to a corporate policy or an on-premises line-of-business application dependency.

备用登录 ID 允许配置登录体验,用户可以使用其 UPN 以外的属性(如邮件)登录。Alternate login ID allows you to configure a sign-in experience where users can sign-in with an attribute other than their UPN, such as mail.

若要在 Azure AD 中启用备用登录 ID,可以使用 Azure AD Connect,而无需执行任何附加的配置步骤。To enable Alternate login ID with Azure AD, no additional configurations steps are needed when using Azure AD Connect. 可以直接通过向导配置备用 ID。Alternate ID can be configured directly from the wizard. 请参阅“同步”部分中适用于用户的 Azure AD 登录配置。在“用户主体名称”下拉列表中,选择“备用登录 ID”对应的属性。See Azure AD sign-in configuration for your users under the section Sync. Under the User Principal Name drop-down, select the attribute for Alternate login ID.

突出显示“用户主体名称”列表的屏幕截图,你在其中选择了“备用登录 ID”属性。

有关详细信息,请参阅配置备用登录 IDAzure AD 登录配置For more information, see Configure Alternate login ID and Azure AD sign-in configuration

未验证的 UPN 后缀Non-verified UPN Suffix

如果本地 UserPrincipalName 属性/备用登录 ID 后缀未在 Azure AD 租户中验证,则 Azure AD UserPrincipalName 属性值将设置为 MOERA。If the on-premises UserPrincipalName attribute/Alternate login ID suffix is not verified with Azure AD Tenant, then the Azure AD UserPrincipalName attribute value is set to MOERA. Azure AD 基于 Azure AD MailNickName 属性和 <MailNickName>@<初始域> 形式的 Azure AD 初始域计算 MOERA。Azure AD calculates the MOERA from the Azure AD MailNickName attribute and Azure AD initial domain as <MailNickName>@<initial domain>.

已验证的 UPN 后缀Verified UPN suffix

如果本地 UserPrincipalName 属性/备用登录 ID 后缀已在 Azure AD 租户中验证,则 Azure AD UserPrincipalName 属性值与本地 UserPrincipalName 属性/备用登录 ID 值相同。If the on-premises UserPrincipalName attribute/Alternate login ID suffix is verified with the Azure AD Tenant, then the Azure AD UserPrincipalName attribute value is going to be the same as the on-premises UserPrincipalName attribute/Alternate login ID value.

Azure AD MailNickName 属性值计算Azure AD MailNickName attribute value calculation

由于 Azure AD UserPrincipalName 属性值可能设置为 MOERA,因此,必须了解 Azure AD MailNickName 属性值(MOERA 前缀)的计算方式。Because the Azure AD UserPrincipalName attribute value could be set to MOERA, it is important to understand how the Azure AD MailNickName attribute value, which is the MOERA prefix, is calculated.

将用户对象首次同步到 Azure AD 租户后,Azure AD 会按顺序检查以下各项,并将 MailNickName 属性值设置为现有的第一个值:When a user object is synchronized to an Azure AD Tenant for the first time, Azure AD checks the following items in the given order and sets the MailNickName attribute value to the first existing one:

  • 本地 mailNickName 属性On-premises mailNickName attribute
  • 主要 SMTP 地址的前缀Prefix of primary SMTP address
  • 本地 mail 属性的前缀Prefix of on-premises mail attribute
  • 本地 userPrincipalName 属性/备用登录 ID 的前缀Prefix of on-premises userPrincipalName attribute/Alternate login ID
  • 次要 smtp 地址的前缀Prefix of secondary smtp address

将用户对象更新同步到 Azure AD 租户后,仅当本地 mailNickName 属性值发生更新时,Azure AD 才会更新 MailNickName 属性值。When the updates to a user object are synchronized to the Azure AD Tenant, Azure AD updates the MailNickName attribute value only in case there is an update to the on-premises mailNickName attribute value.

重要

仅当已将本地 UserPrincipalName 属性/备用登录 ID 值更新同步到 Azure AD 租户时,Azure AD 才会重新计算 UserPrincipalName 属性值。Azure AD recalculates the UserPrincipalName attribute value only in case an update to the on-premises UserPrincipalName attribute/Alternate login ID value is synchronized to the Azure AD Tenant.

每当 Azure AD 重新计算 UserPrincipalName 属性时,也会重新计算 MOERA。Whenever Azure AD recalculates the UserPrincipalName attribute, it also recalculates the MOERA.

UPN 方案UPN scenarios

下面是根据给定的方案计算 UPN 的示例方案。The following are example scenarios of how the UPN is calculated based on the given scenario.

应用场景 1:未验证的 UPN 后缀 - 初始同步Scenario 1: Non-verified UPN suffix - initial synchronization

方案 1

本地用户对象:On-Premises user object:

  • mailNickName:<未设置>mailNickName : <not set>
  • proxyAddresses:{SMTP:us1@contoso.com}proxyAddresses : {SMTP:us1@contoso.com}
  • mail:us2@contoso.commail : us2@contoso.com
  • userPrincipalName:us3@contoso.comuserPrincipalName : us3@contoso.com

首次将用户对象同步到 Azure AD 租户Synchronized the user object to Azure AD Tenant for the first time

  • 将 Azure AD MailNickName 属性设置为主要 SMTP 地址前缀。Set Azure AD MailNickName attribute to primary SMTP address prefix.
  • 将 MOERA 设置为 <MailNickName>@<初始域>。Set MOERA to <MailNickName>@<initial domain>.
  • 将 Azure AD UserPrincipalName 属性设置为 MOERA。Set Azure AD UserPrincipalName attribute to MOERA.

Azure AD 租户用户对象:Azure AD Tenant user object:

  • MailNickName:us1MailNickName : us1
  • UserPrincipalName:us1@contoso.partner.onmschina.cnUserPrincipalName : us1@contoso.partner.onmschina.cn

应用场景 2:未验证的 UPN 后缀 - 设置本地 mailNickName 属性Scenario 2: Non-verified UPN suffix - set on-premises mailNickName attribute

方案 2

本地用户对象:On-Premises user object:

  • mailNickName:us4mailNickName : us4
  • proxyAddresses:{SMTP:us1@contoso.com}proxyAddresses : {SMTP:us1@contoso.com}
  • mail:us2@contoso.commail : us2@contoso.com
  • userPrincipalName:us3@contoso.comuserPrincipalName : us3@contoso.com

将本地 mailNickName 属性更新同步到 Azure AD 租户Synchronize update on on-premises mailNickName attribute to Azure AD Tenant

  • 使用本地 mailNickName 属性更新 Azure AD MailNickName 属性。Update Azure AD MailNickName attribute with on-premises mailNickName attribute.
  • 由于本地 userPrincipalName 属性未更新,因此 Azure AD UserPrincipalName 属性未更改。Because there is no update to the on-premises userPrincipalName attribute, there is no change to the Azure AD UserPrincipalName attribute.

Azure AD 租户用户对象:Azure AD Tenant user object:

  • MailNickName:us4MailNickName : us4
  • UserPrincipalName:us1@contoso.partner.onmschina.cnUserPrincipalName : us1@contoso.partner.onmschina.cn

应用场景 3:未验证的 UPN 后缀 - 更新本地 userPrincipalName 属性Scenario 3: Non-verified UPN suffix - update on-premises userPrincipalName attribute

方案 3

本地用户对象:On-Premises user object:

  • mailNickName:us4mailNickName : us4
  • proxyAddresses:{SMTP:us1@contoso.com}proxyAddresses : {SMTP:us1@contoso.com}
  • mail:us2@contoso.commail : us2@contoso.com
  • userPrincipalName:us5@contoso.comuserPrincipalName : us5@contoso.com

将本地 userPrincipalName 属性更新同步到 Azure AD 租户Synchronize update on on-premises userPrincipalName attribute to Azure AD Tenant

  • 本地 userPrincipalName 属性更新触发 MOERA 和 Azure AD UserPrincipalName 属性的重新计算。Update on on-premises userPrincipalName attribute triggers recalculation of MOERA and Azure AD UserPrincipalName attribute.
  • 将 MOERA 设置为 <MailNickName>@<初始域>。Set MOERA to <MailNickName>@<initial domain>.
  • 将 Azure AD UserPrincipalName 属性设置为 MOERA。Set Azure AD UserPrincipalName attribute to MOERA.

Azure AD 租户用户对象:Azure AD Tenant user object:

  • MailNickName:us4MailNickName : us4
  • UserPrincipalName:us4@contoso.partner.onmschina.cnUserPrincipalName : us4@contoso.partner.onmschina.cn

方案 4:未验证的 UPN 后缀 - 更新主要 SMTP 地址和本地 mail 属性Scenario 4: Non-verified UPN suffix - update primary SMTP address and on-premises mail attribute

方案 4

本地用户对象:On-Premises user object:

  • mailNickName:us4mailNickName : us4
  • proxyAddresses:{SMTP:us6@contoso.com}proxyAddresses : {SMTP:us6@contoso.com}
  • mail:us7@contoso.commail : us7@contoso.com
  • userPrincipalName:us5@contoso.comuserPrincipalName : us5@contoso.com

将本地 mail 属性和主要 SMTP 地址的更新同步到 Azure AD 租户Synchronize update on on-premises mail attribute and primary SMTP address to Azure AD Tenant

  • 完成用户对象的初始同步后,本地 mail 属性和主要 SMTP 地址的更新不会影响 Azure AD MailNickName 或 UserPrincipalName 属性。After the initial synchronization of the user object, updates to the on-premises mail attribute and the primary SMTP address will not affect the Azure AD MailNickName or the UserPrincipalName attribute.

Azure AD 租户用户对象:Azure AD Tenant user object:

  • MailNickName:us4MailNickName : us4
  • UserPrincipalName:us4@contoso.partner.onmschina.cnUserPrincipalName : us4@contoso.partner.onmschina.cn

方案 5:已验证的 UPN 后缀 - 更新本地 userPrincipalName 属性后缀Scenario 5: Verified UPN suffix - update on-premises userPrincipalName attribute suffix

方案 5

本地用户对象:On-Premises user object:

  • mailNickName:us4mailNickName : us4
  • proxyAddresses:{SMTP:us6@contoso.com}proxyAddresses : {SMTP:us6@contoso.com}
  • mail:us7@contoso.commail : us7@contoso.com
  • userPrincipalName:us5@verified.contoso.comuserPrincipalName : us5@verified.contoso.com

将本地 userPrincipalName 属性更新同步到 Azure AD 租户Synchronize update on on-premises userPrincipalName attribute to the Azure AD Tenant

  • 本地 userPrincipalName 属性更新触发 Azure AD UserPrincipalName 属性的重新计算。Update on on-premises userPrincipalName attribute triggers recalculation of Azure AD UserPrincipalName attribute.
  • 由于 UPN 后缀已在 Azure AD 租户中验证,因此会将 Azure AD UserPrincipalName 属性设置为本地 userPrincipalName 属性。Set Azure AD UserPrincipalName attribute to on-premises userPrincipalName attribute as the UPN suffix is verified with the Azure AD Tenant.

Azure AD 租户用户对象:Azure AD Tenant user object:

  • MailNickName:us4MailNickName : us4
  • UserPrincipalName:us5@verified.contoso.comUserPrincipalName : us5@verified.contoso.com

后续步骤Next Steps