Office 365 Unable to update object in Azure Active Directory

In this case there was O365 tenant with multiple federated domains. And after changing the UPN suffix for several users in on premise domain, those changes were not replicated in Azure AD. There was an error generated with following description:

Unable to update this object in Azure Active Directory, because the attribute [FederatedUser.UserPrincipalName], is not valid. Update the value in your local directory services.

There is a support article published by Microsoft with two workarounds on https://support.microsoft.com/en-us/help/2669550/changes-aren-t-synced-by-the-azure-active-directory-sync-tool-after-yo .
In previous cases Set-AzureADUser -ObjectId [DefaultDomainUPN] -UserPrincipalName [NewUPN], was sufficient for resolving the issues with Azure AD synchronization. Unfortunately, in this case executing this cmdlet generated the following error:

Set-AzureADUser : Error occurred while executing SetUser
Code: Request_BadRequest
Message: Property passwordProfile.password value is required but is empty or missing.Details: PropertyName  - passwordProfile.password, PropertyErrorCode  - PropertyRequired
HttpStatusCode: BadRequest
HttpStatusDescription: Bad Request
HttpResponseStatus: Completed

"Property passwordProfile.password value is required but is empty or missing" for the federated user, with ADFS configured and functional ?

Anyway, in order to resolve the issue, I've created new Microsoft.Open.AzureAD.Model.PasswordProfile object with "Password" and "ForceChangePasswordNextLogin" properties. Here is the powershell:

$AADPP = New-Object -TypeName Microsoft.Open.AzureAD.Model.PasswordProfile
$AADPP.Password = “strongP@ssw0rd1!”
$AADPP.ForceChangePasswordNextLogin = “False”

Now, I was able to execute the Set-AzureADUser with following syntax:

Set-AzureADUser -ObjectId [oldDomUPN] -UserPrincipalName [tenant.onmicrosoft.com] -PasswordProfile $AADPP

Set-AzureADUser -ObjectId [tenant.onmicrosoft.com] -UserPrincipalName [NewDomainUPN]

After successful execution of the above cmlets, Azure AD synchronization issues were solved successfully.

Office 365 Hybrid Federated User Free Busy (No Information)

There are a lot of posts regarding resolving free/busy issues, this post is one of them but with simple resolution. In this case it's Office 365 Hybrid implementation with multiple domains hosted in single O365 tenant. On premise exchange organization is Exchange 2013 with latest rollup installed. On premise ADFS is configured, and O365 on-boarded users can successfully access O365 resources using their on-premise domain credentials. Organization Sharing between domains configured successfully.
Having this configuration in place, O365 on-boarded users can collaborate with on-boarded and on-premise users successfully (and vice versa) including free/busy information. But, some O365 on-boarded users reported that they cannot see on-premise mailboxes free/busy information (No Information). Because the free/busy (no) information problem was not for all on-boarded users, but for some of them, the debugging of the issue has started on client level.
The debugging started with internet browser debugging options when connected to OWA and adding user mailboxes to scheduling assistant, and finding the POST request url https://outlook.office.com/owa/service.svc?action=GetUserAvailability... for the added user mailboxes. The response for the requests was "Error" with following information:

"<S:Fault xmlns:S="http://www.w3.org/2003/05/soap-envelope"><S:Code><S:Value>S:Receiver</S:Value></S:Code><S:Reason><S:Text xml:lang="en-US">Internal Server Error</S:Text></S:Reason><S:Detail><psf:error xmlns:psf="http://schemas.microsoft.com/Passport/SoapServices/SOAPFault"><psf:value>0x80048820</psf:value><psf:internalerror><psf:code>0x800478ac</psf:code><psf:text>Provision is needed before federated account can be logged in.</psf:text></psf:internalerror></psf:error></S:Detail></S:Fault>Microsoft.Exchange.Net.WSTrust.SoapFaultException: Soap fault exception received.   at Microsoft.Exchange.Net.WSTrust.SoapClient.EndInvoke(IAsyncResult asyncResult)   at Microsoft.Exchange.Net.WSTrust.SecurityTokenService.EndIssueToken(IAsyncResult asyncResult)   at Microsoft.Exchange.InfoWorker.Common.Availability.ExternalAuthenticationRequest.Complete(IAsyncResult asyncResult)"

This user had a valid licenses assigned and can successfully access O365 resources.

Finally, the resolution for this issue is trivial, by connecting to AzureAD and changing the UserPrincipalName for this user to @tenant.onmicrosoft.com and then return back the UserPrincipalName. Here are the cmdlets:

Set-AzureADUser -ObjectId username@domain.upn -UserPrincipalName "username@tenantname.onmicrosoft.com"
Set-AzureADUser -ObjectId "username@tenantname.onmicrosoft.com" -UserPrincipalName "username@domain.upn"

After this action, the problematic on-boarded O365 user has successfully accessed the free busy information for the on-premise mailboxes.