Authentication fails when email address and UPN do not match
By default, users authenticate using their email address when they use modern authentication. In most environments, the user’s email address and username in
Microsoft Entra ID
are the same and authentication is successful. In hybrid environments, the username attribute in Entra
is synchronized from the UPN value from Active
Directory
. This requires the users' email address and UPN values to match for authentication to be successful. In some environments, users' email addresses and UPN values do not match. In this scenario, authentication will fail because the authentication token returned to the client from
Entra
is identified as being for the wrong user and is rejected. The following client versions provide support for administrators to allow users to authenticate using the UPN instead of their email addresses:
- BlackBerry Work for iOS
- BlackBerry Work for Android
- BlackBerry Notes for Android
- BlackBerry Notes for iOS
- BlackBerry Tasks for Android
- BlackBerry Tasks for iOS
For instructions about how to configure
BEMS
to use an alternate email address to authenticate to BEMS-Docs
, see Enable the use of an alternate email address to authenticate to BEMS-Docs.If users are running earlier versions of the client in your environment, the user email addresses and UPN values match. If these values do not match, modern authentication will fail because the token being returned from
Entra
does not match the email address of the BlackBerry
Dynamics
app. Microsoft
recommends that the email address and UPN match. For more information, visit https://support.blackberry.com/community/s/article/50721 to read article 000050721.