There was O365 tenant with multiple federated domains. And after changing the UPN suffix for several users in on premise domain, those changes were not replicated in Azure AD. There was an error generated with following description:

Unable to update this object inAzure Active Directory, because the attribute[FederatedUser.UserPrincipalName], is not valid. Update the value in your localdirectory services.

There is a support article published by Microsoft with twoworkarounds on https://support.microsoft.com/en-us/help/2669550/changes-aren-t-synced-by-the-azure-active-directory-sync-tool-after-yo.

Sometimes we will see the following error:

Set-AzureADUser : Error occurred while executing SetUser

Code: Request_BadRequest

Message:Property

passwordProfile.password value is required but is empty or missing.Details:PropertyName  - passwordProfile.password,PropertyErrorCode  - PropertyRequired

HttpStatusCode: BadRequest

HttpStatusDescription: Bad Request

HttpResponseStatus: Completed

Use the following powershell:

$AADPP = New-Object -TypeNameMicrosoft.Open.AzureAD.Model.PasswordProfile

$AADPP.Password = “strongP@ssw0rd1!”

$AADPP.ForceChangePasswordNextLogin = “False”

Then execute the Set-AzureADUser with following syntax$AADPP:

1) Import-Csv 'CSVfile path' | ForEach-Object {

$upn = $_."ExistingUPN"

$newupn = $_."DefaultdomainUPN"

Write-Host "Changing UPN value from: "$upn" to: " $newupn-ForegroundColor Yellow

Set-AzureADUser -ObjectId $upn -UserPrincipalName $newupn -PasswordProfile $AADPP }

2) Import-Csv 'CSV file path' | ForEach-Object {

$upn = $_."DefaultdomainUPN"

$newupn = $_."NewUPN"

Write-Host "Changing UPN value from: "$upn" to: "$newupn -ForegroundColor Yellow

Set-AzureADUser -ObjectId $upn -UserPrincipalName $newupn}

It will not affect the users’ existing password because thelog in authentication will still occurs in the local AD.