Ever found yourself in a messed up Hybrid Exchange environment, and some or all of your synced identities are missing something. Maybe the onmicrosoft.com missing domain bug has infected your tenant? (No its not really a bug, and it does not infect you, but shit happens as they say...)
It should be easy to fix, no?
Well it is... but if you google it, you will find suggestions like deleting the users or removing them from sync, then making them cloud only. And then hard or soft matching them again after they have received the _domain_.ONMICROSOFT.COM alias back. That seems like a terrible waste of time if you ask me.
No, you can't just add that domain on-premise to the proxyAddress field and be over with it -- _domain_.ONMICROSOFT.COM is not synced as an alias.
>> The quick(ish) fix
You don't need to delete the user or anything fancy like that to fix that onmicrosoft.com missing default domain -- here are the steps to fix it in production.
>> Add the UPN Suffix to your domain
In order for this fix to work, we need to add the tenant default domain as a UPN Suffix to our on-prem active directory. This is a simple one-time thing.
Open up "Active Directory Domains and Trusts" and follow the steps in the screenshot:
1. Right-click and select the properties of "Active directory domains and trusts" in the MMC
2. Type in your default tenant domain (e.g. mytenant.onmicrosoft.com)
3. Click "Add"
4. Click "OK"
Now we can do some magic on the user-account...
>> Change the users UPN
Now the trick is to change the users logon name to match that of the default tenant domain, because unlike the e-mail alias (proxyAddress), the logon name will actually sync a change if using the default tenant domain.
So crack open your "Active Directory Users and Computers" MMC, and lets follow along with the screenshot:
1. Find the user with issues and go to the "Account" tab.
2. From the User logon name domain name dropdown, NOTE THE CURRENT SELECTION and then select the newly added UPN suffix (i.e. mytenant.onmicrosoft.com)
3. Click "OK"
Now, all you have to do is either wait or force a sync with Entra Connect sync. Forcing it will obviously be faster.
After sync has completed, you should verify that the user login has actually changed in Entra ID or the M365 Admin portal. And at the same time, you can verify that the default domain e-mail alias is now in place as it should be.
>> Put it all back as it was
After you have confirmed that the cloud user has received the changes from on-prem, you simply need to put back the original domain from step 2 in the screenshot above. Then again wait for sync or force it.
If you wish to get rid of the UPN Suffix in your local AD, you can do that at this point, it is no longer needed. Just do sort of the reverse of what we did in the first step.
>> Final words
One could wish for a "fix it" button in Exchange Online or the M365 portal to take care of this little bug of the onmicrosoft.com missing in action. But, I hope I have at least saved you some time by sharing this wacky workaround. Of course all of this can be scripted if you have hundreds or thousands of users in this state.
And before you ask why you even need this domain? Then think about the fact that it is default. And you never really know what 3rd party program or script is expecting to find that specific e-mail Alias on an account.