If your UPN structure doesn't follow your LDAP structure, then LDAP auth from UCM will not work when using UPN as the userid.
So SSO largely makes this a non-issue except in the case of physical phones connecting via Expressway MRA which require UCM auth and not SSO auth.
The only workaround I can come up with is to create a local UCM user for these phones to auth to MRA.
Anyone else have any ideas?