---
description: Yes, ThOse caPitals are coRRect
---

# sAMAccountName & userPrincipalName

### In the beginning was...

`sAMAccountName` which was an attribute used as the logon name for earlier versions of Windows; NT4 and all that. When Microsoft realized the internet was a thing, they introduced a logon name that was [RFC 822](https://www.ietf.org/rfc/rfc0822.txt) compliant the `userPrincipalName` (UPN). It wasn't broadly adopted (except for PKI) until Office 365 required its use as the primary logon name for their cloud services. Since then the logon name has coalesced around UPN as the standard and the most important logon identity attribute in their directory.

{% embed url="https://docs.microsoft.com/en-us/windows/win32/ad/naming-properties" %}

A common deployment for Tableau Server integrates the server with Active Directory as the external identity store. As Tableau Server has been around for a while it still uses `sAMAccountName` when you sync users into the repository from Active Directory; and this then becomes your Tableau Server username.

![](https://3088636806-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MTNc1yqFWMiF2_FfNrL%2F-MZ-b8QNI9bwDFDCWPSJ%2F-MZ-olg5RX8L3RPDkhqn%2Fimage.png?alt=media\&token=8feae663-8887-4646-b192-0a0172160e09)

{% hint style="info" %}
**At present it is not possible to change this to UPN for Tableau Server using Active Directory as an External Identity Store.**
{% endhint %}

### Exceptions to sAMAccountName (support issues)

There are some exceptions to this AD user sync logic described in our [docs](https://help.tableau.com/current/server/en-us/users_manage_ad.htm) when the normal sync of`sAMAccountName` doesn't work. But this is **not** how to import UPN as a choice.

_Exception 1: If the UPN prefix of the user specified is greater than 20 characters, **and** the search string matches the full UPN, **and** is entered with the Windows login format (domain\UPN)._

![UPN prefix over 20 characters](https://3088636806-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MTNc1yqFWMiF2_FfNrL%2F-M_NPGyi9R6P7SfU9woT%2F-M_NPIim0xoOmx5nJDOR%2Fimage.png?alt=media\&token=8ac7cca4-00d2-4429-935f-afe1d04e5584)

![Import like this](https://3088636806-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MTNc1yqFWMiF2_FfNrL%2F-M_NPGyi9R6P7SfU9woT%2F-M_NQDLN4GNJXutCwM2Y%2Fimage.png?alt=media\&token=1a8799e4-df6d-4674-8b0b-fe2447859e11)

This imported the user with the UPN prefix as the username and not the sAMAcountname:

![](https://3088636806-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MTNc1yqFWMiF2_FfNrL%2F-M_NPGyi9R6P7SfU9woT%2F-M_NRdH_UYSYyqJ_gmkD%2Fimage.png?alt=media\&token=7f5d2de4-54a3-4646-8f22-05e55530c514)

_Exception 2: If the user name you specify includes an `@`symbol in the UPN prefix **and** the search string you enter is either in the Windows domain login format (`example.lan\jsmith@domain`) or is the full UPN._

![Another @!](https://3088636806-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MTNc1yqFWMiF2_FfNrL%2F-M_NPGyi9R6P7SfU9woT%2F-M_NUjlgmDp3t8E_VK-c%2Fimage.png?alt=media\&token=3a935f2e-f814-4fe8-8d96-0d2ea22ac2d6)

![](https://3088636806-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MTNc1yqFWMiF2_FfNrL%2F-M_NPGyi9R6P7SfU9woT%2F-M_NUe2wQH-a6_Fe4pNb%2Fimage.png?alt=media\&token=d6a3d2d3-4822-4168-b627-b1d5af52c639)

> If user names were inadvertently imported using UPN names, you can delete the accounts in Tableau Server and then reimport those accounts using the `sAMAccountName` value for the user name

### So do these exceptions occur with Groups?

In short, no these exceptions do not occur if you sync an Active Directory user group. Tableau will sync all users from the group using the `sAMAccountName`. Importing with Groups has a number of advantages anyway with Grant Licence on Login for example.

### What are the options if you must use/change to UPN as your Tableau username?

1\) Use Active Directory Lightweight Directory Services to present AD as an LDAP service to Tableau

2\) Local Identity Store (requires provisioning of users at scale)

3\) Use LDAP

Migration considerations at a _very_ high level:

* Map the user to the new username
* Migrate the content potentially using Site Export and Import

### How do I use sAMAccountName with Azure AD Authentication?

Conveniently, if you already synchronize your directory to Azure AD then there is the `onpremisessAMAccountName` attribute. This is available to be passed as a claim in your SAML authentication flow to match your on-premises Active Directory provisioned Tableau user. This is described in more detail [here](https://johnthompson365.gitbook.io/iamtableau/user-authentication/recipe-azure-ad-saml-and-tableau-online#tableau-server).

### What happens if you have multiple UPN suffixes?

#### What's a UPN suffix?

> Active Directory Domain Services (AD DS) domains have two types of names: Domain Name System (DNS) names and NetBIOS names. In general, both names are visible to end users. The DNS names of Active Directory domains include two parts, a prefix and a suffix. When creating domain names, first determine the DNS prefix. This is the first label in the DNS name of the domain. The suffix is determined when you select the name of the forest root domain.&#x20;

{% embed url="https://docs.microsoft.com/en-us/windows-server/identity/ad-ds/plan/assigning-domain-names" %}

You can create additional UPN suffixes, often to match the email addresses in use in your org so your users just have to remember 1 identity.

![More suffixes please](https://3088636806-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MTNc1yqFWMiF2_FfNrL%2F-M_XxTVm2_JF5hDf-CNZ%2F-M_XzKoGXJ8KVJa95S5N%2Fimage.png?alt=media\&token=f67c8ecd-6a9c-41b4-8536-acb3d15fe3bc)

UPN suffixes are then assigned to your users within your Active Directory forest.&#x20;

![A user with a different UPN suffix to the ](https://3088636806-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MTNc1yqFWMiF2_FfNrL%2F-M_NWsE9Uj_AIv4RtxXZ%2F-M_NYh8Mo5vzhyvigleu%2Fimage.png?alt=media\&token=69b654bf-c923-4162-b212-6f33c13a82d8)

As you can see below you can have a different UPN suffix but still be in the same domain.

![Repository](https://3088636806-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MTNc1yqFWMiF2_FfNrL%2F-M_NWsE9Uj_AIv4RtxXZ%2F-M_NZ5JB8COPZalbNYQu%2Fimage.png?alt=media\&token=cb016bab-af92-4a7f-9f56-c8e90624dfe6)

This is also confirmed by running `tabcmd listdomains` where I still only have the THOMPSON365 domain visible to the server.

![tabcmd listdomains](https://3088636806-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MTNc1yqFWMiF2_FfNrL%2F-M_boPChzO2D85iIwSnG%2F-M_c0-BTOJWfAoCxT6tJ%2Fimage.png?alt=media\&token=07c74366-fc66-4527-9992-bd6bcd746a9a)

However, if you logon to Tableau with a different UPN suffix than your 'Domain Name' then you will receive this error.

![](https://3088636806-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MTNc1yqFWMiF2_FfNrL%2F-MZ-b8QNI9bwDFDCWPSJ%2F-MZ-jEn4rEvdJVUzJoxz%2Fimage.png?alt=media\&token=76ead6dd-12e1-40f6-84ed-48080973adc0)

Checking out the vizportal logs:

![](https://3088636806-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MTNc1yqFWMiF2_FfNrL%2F-MZ-b8QNI9bwDFDCWPSJ%2F-MZ-pgeMnrJz1_jpGf0Y%2Fimage.png?alt=media\&token=0c88b078-17c7-4b61-bea5-f3637eeb9372)

You need to ensure that all of your suffixes are added to the Tableau domain allow list similar to if you were working with a multi-domain deployment.&#x20;

{% embed url="https://help.tableau.com/current/server/en-us/cli_configuration-set_tsm.htm#wgserver-domain-acceptlist" %}

![](https://3088636806-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MTNc1yqFWMiF2_FfNrL%2F-M_NWsE9Uj_AIv4RtxXZ%2F-M_NZLtX5n8D097Q40tj%2Fimage.png?alt=media\&token=31c97af6-93b8-4e71-9d02-2c7fbaf3f163)

#### Sync/Logging strangeness

I can add users as part of a group with a different UPN suffix and do not receive the DEBUG event that it has recognised the user with a different UPN.

![](https://3088636806-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MTNc1yqFWMiF2_FfNrL%2F-M_h2MRh1vr7D0DFnYHH%2F-M_h3PTZ25qMkQnpT8GL%2Fimage.png?alt=media\&token=347e575f-ea2d-4113-a4b4-aadd3221cbaf)
