Jason (Izzy) Sherry's Blog

# WARNING: FOR EXAMPLE, NON-PRODUCTION USE 
# For more details see http://izzy.org/scripts/Warning.htm
#
# This script will set the on-premises UPN and Office 365 UPN value for a user
# to their PrimarySMTPAddress. DirSync/Azsure AD Sync will not sync UPN changes
# from on-premises to Office 365. So this script connects to O365 to make the 
# change directly.
#
# Source: http://izzy.org/scripts/O365/Set-UPN-O365-PSMTP.ps1
# Created 7/11/2014 | Last Updated 8/18/2015
#	8/22/14: Added checking for SamAccountName@UPNSuffix for O365 account, added more error handling, and more logging info
# 8/18/15: Renamed from Set-UPN-O365 to Set-UPN-O365-PSMTP.ps1
#
# Usage: .\Set-UPN-O365-PSMTP.ps1 <Filter> [<SearchBase>]
# Where: <Filter> is the filter to be used with the Get-ADUser command
#				 <SearchBase> is the optional OU to run the script against
#				 <SearchScope> controls the search level, defaults to [Subtree]
# Examples:	.\Set-UPN-O365-PSMTP.ps1 * -SearchBase "CN=Users,DC=Company,DC=Com"
#						.\Set-UPN-O365-PSMTP.ps1 * -SearchBase "OU=Sales,DC=Company,DC=Com"
#

param(
	[Parameter(Mandatory = $true)]
	[String]$Filter,
	[String]$SearchBase,
	[String]$SearchScope
)

$LocalDomain = "COMPANY"
$UPNSuffix = "company.com"

# Requires MS Online Services Sign-In Assistant -> http://www.microsoft.com/en-us/download/details.aspx?id=41950
# Requires above, Windows Azure PowerShell required to update Office 365 -> http://go.microsoft.com/fwlink/p/?linkid=236297
# For Filter examples see: http://blogs.msdn.com/b/adpowershell/archive/2009/04/14/active-directory-powershell-advanced-filter-part-ii.aspx

$MakeChanges = $False
$UpdateO365 = $True
$LogFile = "Set-UPN-O365-PSMTP.log"

If (!$MakeChanges) {Write-Host "MakeChange is set to False, changes will not be saved" -ForegroundColor Yellow}
If (!$UpdateO365) {Write-Host "UpdateO365 is set to False, changes will not be saved to Office 365" -ForegroundColor Yellow}

Import-module ActiveDirectory
If ($UpdateO365) {
	Import-Module MSOnline
	If (!$Global:O365Credentials) {
		write-output "Enter credentials for an org admin account in Office 365."
		$Global:O365Credentials = $host.ui.PromptForCredential("Need Office 365 credentials", "Please enter your user name and password.", "$env:username@$UPNSuffix", "UPN")}
	connect-msolservice -credential $Global:O365Credentials
}

If (!$SearchBase) {$SearchBase = $(Get-ADDomain).DistinguishedName}
If (!$SearchScope) {$SearchScope = "Subtree"}

Write-Host "Getting users under [$SearchBase] with a Filter of [$Filter]`n" -ForegroundColor Green
$Users = Get-ADUser -SearchScope $SearchScope -SearchBase "$SearchBase" -Filter $Filter -Properties mail
#$Users = Get-ADUser -SearchScope $SearchScope -SearchBase "$SearchBase" -Filter {sAMAccountName -eq "DChoudhu"} -Properties mail

"Local account: $env:username,Office 365 Account: $($Global:O365Credentials.UserName),Started: $(Get-Date -f "MM/dd/yyyy HH:mm:ss"),Information" | Out-File -Append $LogFile
"Filter: $Filter, SearchScope: $SearchScope, SearchBase: $SearchBase, Information" | Out-File -Append $LogFile

$Users | ForEach {
	$ADUser = $_
	If ($($ADUser.Mail)) {
		$PrimarySmtpAddress = $ADUser.Mail
		$SamAccountName = $ADUser.SamAccountName
		$CurrentUPN = $ADUser.UserPrincipalName
		Write-Host "Updating: $LocalDomain\$SamAccountName | Local UPN: [$CurrentUPN]" -ForegroundColor Cyan
		$ErrorInfo = ""
		$Updated = $False
		
		If ($ADUser.UserPrincipalName -ne $PrimarySmtpAddress) {
			Write-Host "  Local UPN: $CurrentUPN | New UPN: $PrimarySmtpAddress" -ForegroundColor Cyan
#			"$SamAccountName, $PrimarySmtpAddress, $CurrentUPN, Information, Local user updated" | Out-File $LogFile -Append
			If ($MakeChanges) {Set-ADUser $ADUser.DistinguishedName -UserPrincipalName $PrimarySmtpAddress}
			$Updated = $True
		}
		Else {Write-Host "  Local UPN already matches"  -ForegroundColor Green}
		If ($UpdateO365) {
			
			$O365User = $Null
			$LegacyUPN = "$($SamAccountName)@$($UPNSuffix)"
			$error.clear()
			$O365UPN = $CurrentUPN
			Try {$O365User = Get-MsolUser -UserPrincipalName $CurrentUPN -ErrorAction Stop}
			Catch {
				If ($_.Exception.Message -like "*User Not Found*") {
					$ErrorInfo = "O365 user not found UPN: [$CurrentUPN]"
					"$SamAccountName, $PrimarySmtpAddress, $CurrentUPN, Error, O365 user not found current UPN" | Out-File $LogFile -Append
					Write-Host "    User with UPN of [$CurrentUPN] was not found.`n    Searching using legacy UPN format: [$LegacyUPN]." -ForegroundColor Yellow
				}
				Else {
					write-error $("TRAPPED: " + $_.Exception.GetType().FullName)
					write-error $("TRAPPED: " + $_.Exception.Message)
				}
			}
			$error.clear()
			If (!$O365User) {
				$O365UPN = $LegacyUPN
				Try {$O365User = Get-MsolUser -UserPrincipalName $LegacyUPN -ErrorAction Stop}
				Catch {
					If ($_.Exception.Message -like "*User Not Found*") {
						$ErrorInfo = "O365 user not found Legacy UPN"
						"$SamAccountName, $PrimarySmtpAddress, $LegacyUPN, Error, $ErrorInfo" | Out-File $LogFile -Append
						Write-Host "    User with UPN of [$LegacyUPN] was not found and will not be updated." -ForegroundColor Red
					}
					Else {
						write-error $("TRAPPED: " + $_.Exception.GetType().FullName)
						write-error $("TRAPPED: " + $_.Exception.Message)				
					}
				}
			}
			If ($O365User) {
				$ErrorInfo = ""
				If ($O365User.UserPrincipalName -ne $PrimarySmtpAddress) {
					Write-Host "  O365 UPN: $O365UPN | New UPN: $PrimarySmtpAddress" -ForegroundColor Cyan
					$Updated = $True
					$error.clear()
					Try { If ($MakeChanges) {Set-MsolUserPrincipalName -UserPrincipalName $O365UPN -NewUserPrincipalName $PrimarySmtpAddress -ErrorAction Stop}}
					Catch {
						$Updated = $False
						write-error $("TRAPPED: " + $_.Exception.GetType().FullName)
						write-error $("TRAPPED: " + $_.Exception.Message)
						"$SamAccountName, $PrimarySmtpAddress, $CurrentUPN, Error, Type: $($_.Exception.GetType().FullName)" | Out-File $LogFile -Append
					}
				}
				Else {Write-Host "  Office 365 UPN already matches"  -ForegroundColor Green}
				
			}
		} # If ($UpdateO365)
		If (!$ErrorInfo) {If ($Updated) {$ErrorInfo = "Updated"}Else {$ErrorInfo = "Already matched"}}
		"$SamAccountName, $PrimarySmtpAddress, $CurrentUPN, Information, $ErrorInfo" | Out-File $LogFile -Append
	} # IF Mail
} #ForEach