It sounds like the issue you're experiencing is related to how DUO is interpreting or syncing the user accounts, and specifically how the usernames are being matched between Microsoft Entra ID (formerly Azure AD) and DUO. Based on your description, DUO is trying to match the userPrincipalName (typically the full email address like fLastname@domain.com), but it's not finding the right account unless an alias like FirstnameLastname is added.
Here are a few additional suggestions to help resolve the issue:
1. Verify User Principal Name (UPN) Consistency
The issue likely arises from DUO not finding the user in the system when you sign in with the fLastname@domain.com email address. This is expected if DUO is using a different attribute or format.
Check if UPN format is consistent:
Ensure that the userPrincipalName (UPN) in Entra ID matches the format expected in DUO.
Verify that the username attribute in DUO is correctly set to userPrincipalName in Microsoft Entra ID.
Consider a mismatch in domain formats:
If the fLastname@domain.com is different from the UPN used in your organization’s directory or DUO, you may need to ensure consistency in domain settings. Sometimes, Entra ID might sync with a PrimarySMTP or other email identifiers, and DUO needs to know exactly what format the usernames are in.
2. Check DUO Enrollment Policy
Enroll Users Manually: If users are not enrolling themselves into DUO, you can check the DUO enrollment policy to ensure that users are being prompted to enroll after their first sign-in.
In DUO, go to Administrators > Enrollment and verify if automatic enrollment is enabled.
You can also manually trigger enrollment invitations from DUO Admin > Users.
Check the DUO Sync Logs:
The DUO Admin console has detailed logs of sync activity. Check if there were any errors or warnings during the user sync process that might indicate why the users' credentials aren't syncing properly.
3. Attribute Mappings and Sync Settings
Ensure that the attribute mapping between Microsoft Entra ID and DUO is correct:
Go to the DUO Admin Console > Users and check if the userPrincipalName from Entra ID is correctly syncing.
If you added the alias to make it work (FirstnameLastname), this suggests that DUO might be associating with the mail attribute rather than the userPrincipalName. Double-check these mappings.
4. DUO Device Enrollment
Check if the user's device is enrolled and trusted in DUO, as DUO sometimes checks for trusted devices during authentication:
Go to DUO Admin Console > Devices and check if the users are listed and marked as enrolled.
5. Testing with Specific User:
To isolate the issue further, you could test the login and enrollment process with a specific test user:
Try to sign in with a test user using the fLastname@domain.com format.
Check DUO’s logs for that test user during the authentication attempt.
Ensure that this user is not in a pending state in the DUO Admin Console (this can sometimes happen if the sync process hasn't fully completed).
6. Syncing Issues (Force a Sync):
Sometimes, syncing issues can happen, especially if there’s a delay between Microsoft Entra ID and DUO. You might want to:
Force a sync in Microsoft Entra ID by going to the Azure AD Connect console if you're using it.
Trigger a manual sync in DUO via the Sync Now option in the DUO Admin Console to ensure everything is fully up-to-date.
7. DUO Troubleshooting Mode
DUO provides a useful debugging tool that can help you identify issues during the login process:
Go to DUO Admin Console > Authentication > Log Events.
Look for any errors related to user enrollment, sync issues, or the specific AADSTS900144 error and see if there are any clues as to what might be going wrong.
8. Clear Cache and Re-enroll Users
If some users are experiencing issues, it might be worth:
Clearing the browser cache for the users and testing again.
Re-enrolling users by deleting and re-adding them to the DUO system, then verifying if the issue persists.
Final Check: Test with UPN Matching
To summarize, you should check the following:
Ensure that userPrincipalName (fLastname@domain.com) is correctly mapped in DUO’s configuration.
Double-check the enrollment policies in DUO to ensure users are being prompted to enroll automatically.
Verify whether DUO is using userPrincipalName or mail to match the usernames.
