title: Update AzureAD/O365 UPN via Graph
body: <p>I am attempting to update the UPN of an Azure AD user (loaded with Azure AD Connect) in a federated domain via MS Graph leveraging the .Net ADAL library in Powershell.  I am reasonably certain that I have everything configured correctly within Azure and in the PS, because if I issue a command to update the usageLocation attribute, it works (clipped for brevity):</p>
  
  <pre><code>$UPN="user@mytenant.edu"
  $Body=@{UsageLocation="JP"} | ConvertTo-JSON
  $Result=Invoke-RestMethod -Method PATCH -Uri "https://graph.microsoft.com/v1.0/users/${UPN}" -Headers @{Authorization=$authenticationResult.CreateAuthorizationHeader()} -ContentType "application/json" -Body $Body
  $user=Invoke-RestMethod -Method GET -Uri "https://graph.microsoft.com/v1.0/users/${UPN}?`$select=usageLocation" -Headers @{Authorization=$authenticationResult.CreateAuthorizationHeader()} -ContentType "application/json"
  $user.usageLocation
  
  JP
  </code></pre>
  
  <p>But, if I attempt to update the UPN to a non-federated domain (so I do not run afoul of the issue described in <a href="http://blogs.perficient.com/microsoft/2013/03/changing-upn-for-office-365-account-between-two-sso-domains/" rel="nofollow">http://blogs.perficient.com/microsoft/2013/03/changing-upn-for-office-365-account-between-two-sso-domains/</a>), I get back an Internal Server Error (500):</p>
  
  <pre><code>$UPN="user@mytenant.edu"
  $Body=@{userPrincipalName="user@tenant.onmicrosoft.com"} | ConvertTo-JSON
  $Result=Invoke-RestMethod -Method PATCH -Uri "https://graph.microsoft.com/v1.0/users/${UPN}" -Headers @{Authorization=$authenticationResult.CreateAuthorizationHeader()} -ContentType "application/json" -Body $Body
  
  Invoke-RestMethod : The remote server returned an error: (500) Internal Server Error.
  </code></pre>
  
  <p>I've tried many different variations, including retrieving the Azure AD GUID and using that rather than UPN in the PATCH command and using the older Azure AD Graph (which returns the same 500 error).  I can make the change using O365 Powershell commands:</p>
  
  <pre><code>Set-MsolUserPrincipalName -UserPrincipalName $UPN -NewUserPrincipalName $newUPN
  </code></pre>
  
  <p>but I can't seem to make it work via MS Graph.  The docs for graph imply that UPN can be updated like other attributes (c.v. <a href="http://graph.microsoft.io/en-us/docs/api-reference/v1.0/api/user_update" rel="nofollow">http://graph.microsoft.io/en-us/docs/api-reference/v1.0/api/user_update</a>, for example). I'm wondering though if because UPN is a key, maybe that makes update not work?  I also don't think this is a permission issue, those usually throw "Insufficient privileges to complete the operation." which is not what I'm seeing. </p>
  
  <p>Thank you!</p>
  
  <p>UPDATE1: Here's everything I can fish out of the Error object from a re-attempt this morning :</p>
  
  <pre><code>{
    "error": {
      "code": "Service_InternalServerError",
      "message": "Encountered an internal server error.",
      "innerError": {
        "request-id": "cbb08d3c-1143-4d0b-8722-5230b00bd00f",
        "date": "2016-02-15T16:48:15"
      }
    }
  }
  </code></pre>