Microsoft Entra ID – Updated User UPN Not Reflecting in Adobe Admin Console Despite Successful Provisioning Configuration

Run Provision on demand for the affected user and inspect the Import, Scope, Match, and Perform action stages; this will identify whether the changed UPN is mapped to Adobe userName, excluded from scope, or no longer matches the existing Adobe identity.

1. Test the affected user directly

1. In the Microsoft Entra admin center, go to: Entra ID → Enterprise apps → Adobe Identity Management (OIDC) → Provisioning → Provision on demand.
2. Search using the user’s new UPN, select the user, and choose Provision.
3. Open View details and examine:
   • Import user: Confirm the new userPrincipalName is imported.
   • Determine if user is in scope: Confirm assignment, role, and scoping-filter results.
   • Match user between source and target: Check whether exactly one existing Adobe account is found.
   • Perform action: Check whether userName or email is updated, skipped, or rejected.

On-demand provisioning evaluates mappings, scope, and target matching and shows the attributes actually exported to Adobe. A matching attribute must be present, unique, and supported for filtering by the target system.^1^

2. Check the Adobe user mapping

Go to:

Entra ID → Enterprise apps → Adobe Identity Management (OIDC) → Provisioning → Attribute Mapping → users

Review these items:

• Verify that the source attribute containing the new UPN—normally userPrincipalName—maps to Adobe’s userName.
• Confirm that mapping has Apply this mapping = Always, rather than only during object creation, if that option is shown.
• Check the mapping for emails[type eq "work"].value separately. Changing a UPN does not necessarily change the source mail attribute, so Adobe email will not change unless its mapped source attribute also changes.
• Identify the mapping marked Match objects using this attribute and its matching precedence.

For the Adobe OIDC connector, userName is required and supports filtering. Attributes selected as Matching properties are used to locate Adobe accounts for update operations.^2^

Do not change the matching property merely to force the rename. The Adobe API must support filtering on the selected target attribute, and changing matching logic can create an unmatched or duplicate identity.

3. Interpret the match result

Existing Adobe user is matched

If the existing account is matched but no update is sent:

• Check whether userPrincipalName → userName is present and enabled for updates.
• Compare the imported source value with the final exported value.
• Confirm that the Adobe value is actually different.
• Save any corrected mapping and rerun Provision on demand.

Mappings determine which values flow during creation and updates. Incremental provisioning monitors Microsoft Graph changes, but it retrieves and exports the attributes defined in the mappings.^3^

No Adobe user is matched, or multiple users match

A UPN change can break an application relationship when the application uses the UPN as the identity key. Microsoft recommends immutable identifiers such as object ID where an integration supports them; SaaS applications that depend on UPN can otherwise lose the relationship or create another profile.^4^

In this case:

• Do not allow provisioning to create a second Adobe account until the match is corrected.
• Check for an Adobe account under both the old and new usernames.
• Ensure the configured matching value uniquely identifies the existing Adobe user.
• If Adobe cannot rename or match that identity through its API, Adobe support must confirm the supported account-rename or relinking procedure.

4. Why there may be no log entry

All operations actually performed by the provisioning service are recorded in the provisioning logs. Search using the user’s display name, old UPN, new UPN, and target identifier at:

Entra ID → Enterprise apps → Adobe Identity Management (OIDC) → Provisioning logs.^5^

If none appears, the provisioning job likely did not process that user after the rename. Check:

• Provisioning → Current Status: verify the incremental cycle has run since the UPN change.
• Scope: confirm the app uses the expected Sync only assigned users and groups or Sync all users and groups setting.
• Scoping filters: a filter based on UPN, domain, email, or another changed attribute can exclude the user.
• Group assignment: the user must be an immediate member of an assigned group; nested groups are not processed for assignment-based provisioning.
• Effective entitlement: if on-demand reports the user is not effectively entitled, unassign and reassign the user or assigned group. Microsoft documents this as the remediation for a broken assignment record.^6^

SSO success does not prove that outbound provisioning processed the rename: authentication and SCIM provisioning are separate operations. The on-demand result is therefore the most useful next diagnostic artifact.

References

1. On-demand provisioning in Microsoft Entra ID (app-provisioning)
2. Configure Adobe Identity Management (OIDC) for automatic user ...
3. How Application Provisioning works in Microsoft Entra ID
4. Plan and troubleshoot UserPrincipalName changes in Microsoft Entra ID
5. Report automatic user account provisioning from Microsoft Entra ID to ...
6. Troubleshoot provisioning to a Microsoft Entra gallery app. - Microsoft ...