By default, users authenticate using their email address when they use modern authentication. In most environments, the user’s email address and username in Microsoft Entra ID are the same and authentication is successful. In hybrid environments, the username attribute in Entra is synchronized from the UPN value from Active Directory. This requires the users' email address and UPN values to match for authentication to be successful.

In some environments, users' email addresses and UPN values do not match. In this scenario, authentication will fail because the authentication token returned to the client from Entra is identified as being for the wrong user and is rejected.

For instructions about how to configure BEMS to use an alternate email address to authenticate to BEMS-Docs, see Enable the use of an alternate email address to authenticate to the Docs service.

If users are running earlier versions of the client in your environment, the user email addresses and UPN values match. If these values do not match, modern authentication will fail because the token being returned from Entra does not match the email address of the BlackBerry Dynamics app. Microsoft recommends that the email address and UPN match. For more information, see KB 50721.