During migrations to Exchange Online I get the question regarding special characters in the User Principal Name (UPN) and e-mail address. Every time I have to check this again and again, so it’s time to do a write-up.

The UserPrincipalName (UPN)

The UserPrincipalName (UPN)

The UPN is the user’s identifier in Active Directory, and it is formatted like j.wesselius@exchangelabs.nl. It is a Microsoft recommendation to keep the user’s email address and UPN identical, but that’s not a hard requirement.

The UserPrincipalName attribute has the following characteristics and/or requirements:

• The @ character is required.
• The @ character cannot be the first or the last character of a UPN.
• The total length cannot exceed the 113 characters limit. 64 characters in front of the @ character (i.e. username) and 48 characters after the @ character (i.e. domain name).
• Allowed characters are A – Z, a – z, 0 – 9, ‘ . – _ ! # ^ ~
• Invalid characters are \ % & * + / = ? { } | < > ( ) ; : , [ ] “
• An Umlaut, tilde and accents are also invalid characters.
• The UPN cannot end with a dot.
• The UPN cannot contain spaces.
• With directory synchronization in mind:
  • a routable domain must be used for the UPN (for a stand-alone AD this is not the case).
  • UPN must be unique and cannot contain any duplicated value in the directory (like UPN of user A is the same as e-mail address of user B).

The last bullet is something I see a lot in hybrid scenarios. In Exchange 2019 it is possible to have a user with a UPN like J.Doe@exchangelabs.nl, and another user with an identical email address J.Doe@exchangelabs.nl. Although it is confusing, it is possible on-premises.

In Exchange Online this is not possible, and when you have Entra ID in place, it will generate error messages, and strip the email address from the second user. Needless to say, you must fix this inconsistency (which can be problematic since you must remove an email address from a mailbox).

A little bit related is the samAccountName attribute of a user. This has the following limitations:

• The maximum length is 20 characters.
• It must be unique in the entire organization.
• The following characters are invalid: [ ] \ | / , : < > + = ; ? * ‘ and the double quoute character “

Email Addresses

In Exchange and Exchange Online there are four e-mail address related attributes:

• The mail attribute. The mail attribute of a recipient must be unique in the entire organization.
• mailNickName (or alias). Must be unique in the entire organization and it cannot start with a period.
• ProxyAddresses. This is a multi-valued attribute and has the following restrictions:
  • The maximum length of an entry is 256 characters.
  • It cannot contain a space character.
  • It must be unique in the entire organization.
  • It cannot contain any of the following characters: < > ( ) ; , [ ] and a double quote character “. The colon character : is allowed, but only after an identifier like SMTP: or X500:
  • Special characters with an umlaut, accent or tilde are invalid.
  • TargetAddress. This is used for forwarding email messages, in a hybrid environment this is the remote routing address. It is a singe value attribute, and has the same limitations as the proxyAddresses attribute.

Most likely there are more related attributes that need attention, but these are the most interesting I see when working with customers.