Entra ID prereq Netbios question

Question

Entra ID prereq Netbios question

Susan Dodds 441

Using on-premises forests or domains by using "dotted" (name contains a period ".") NetBIOS names isn't supported.

My domain name is contoso.local.

Using powershell, it says my Netbios name is contoso

(Get-ADDomain).NetBIOSName

I also have an Exchange server on my forest.

Am I good or do I need to somehow change my domain name?

Thanks

0 comments

2 answers

Your answer

Answer 1

Your existing Active Directory domain, contoso.local, is supported for synchronization with Microsoft Entra ID. You do not need to rename your AD domain, change its DNS name, or change its NetBIOS name. The restriction concerning .local relates to using that namespace as a verified domain in Microsoft Entra ID, not to using it as the internal DNS namespace of an on-premises AD forest.

There are two separate names involved. Your on-premises AD domain has the DNS name contoso.local and the NetBIOS name CONTOSO. Entra ID does not require the on-premises DNS domain name to match a verified Entra custom domain. It does, however, require a publicly verifiable domain for the custom domain you want to use for cloud identities. Since .local is not a publicly registrable DNS namespace, you cannot verify contoso.local in your Entra tenant.

The usual configuration is to retain contoso.local for AD DS and add a publicly registered domain, such as contoso.com, to your Entra tenant. You verify ownership of contoso.com by adding the TXT record Microsoft provides to your public DNS zone. You then add contoso.com as an alternative UPN suffix in your on-premises Active Directory and assign it to users who need to sign in using that namespace. For example, a user whose existing AD account is [email protected] can have the UPN ******@contoso.com without changing the underlying AD domain.

When you configure Microsoft Entra Connect Sync or Cloud Sync, the user identities can synchronize from the contoso.local forest into Entra ID using the routable UPN suffix. The on-premises domain remains unchanged. You should also ensure that the UPNs are unique and that the required identity attributes are suitable for synchronization.

Your Exchange server does not change these requirements. Exchange being installed in the contoso.local forest does not prevent Entra ID synchronization, and it does not require an AD domain rename. However, if you use Exchange hybrid, you should separately account for your existing Exchange configuration, accepted domains, email addresses, and hybrid identity requirements when changing users' UPNs.

If the above response helps answer your question, remember to "Accept Answer" so that others in the community facing similar issues can easily find the solution. Your contribution is highly appreciated.

hth

Marcin

Answer 2

contoso.local is the DNS domain name, not the NetBIOS domain name.

If (Get-ADDomain).NetBIOSName returns contoso, then the NetBIOS name does not contain a period, so it is not a "dotted" NetBIOS name.

That means this specific Microsoft Entra Connect prerequisite is satisfied.

Two related points from the documentation:

Microsoft Entra Connect does not support NetBIOS names that contain a dot (.).
Microsoft Entra Connect also does not support forests that contain disjoint namespaces.

For Active Directory, it is normal for a DNS domain name such as contoso.local to have a NetBIOS name such as contoso.

Exchange Server 2013 has documented support for deployment in a disjoint namespace scenario, but that is a separate concept from a dotted NetBIOS name. Based on the details provided, contoso.local with NetBIOS contoso does not indicate a dotted NetBIOS problem.

No domain rename is indicated based on the NetBIOS name shown by PowerShell.