Problem description
When an organization plans a domain or User Principal Name (UPN) suffix change within their Identity Provider (such as Microsoft Entra ID), administrators using Single Sign-On (SSO) to access the Druva Cloud Platform (DCP) may experience authentication issues.
Because existing SSO configurations in Druva rely on the UPN or email address as the unique identifier, updating your domain (for example, transitioning from @old-domain.com to @new-domain.com) without advance preparation can result in:
Administrator login failures after the domain cutover.
The potential creation of duplicate or orphaned administrator accounts in Druva.
Cause
The organization planned a domain change in Microsoft Entra ID (or another IdP), which updates user UPNs from @old-domain.com to @new-domain.com.
Because existing SSO configurations in Druva rely on the UPN as the unique identifier, authenticating with the updated UPN post-cutover without prior configuration changes prevents mapping to the existing administrator account.
Resolution
Confirmed Impact Analysis
Domain/UPN changes affect administrator accounts only.
No updates are required to the existing SSO configuration in Druva if the Entra ID tenant ID and IdP login URLs remain unchanged.
Pre-Cutover Action Plan
Create New Administrator Accounts: Prior to the domain cutover, log in to the DCP console and create new administrator accounts using the
@new-domain.comemail addresses.Complete Password Setup: Ensure each newly created administrator completes the password setup via the welcome email link (valid for 24 hours).
Secure Credentials: Retain the newly created account credentials securely until the domain transition is complete.
Fallback / Lockout Prevention Plan
Set Local Password Backup: Set passwords for existing
@old-domain.comadministrator accounts prior to the cutover as a backup authentication method.Utilize Failsafe Login URL: If SSO authentication fails during cutover, access the Druva Cloud Platform directly using the SSO bypass URL:
https://login.druva.com/?failsafe=True
This bypass allows administrators to log in using their email, password, and Multi-Factor Authentication (MFA) without relying on IdP SSO.
Verification
Log in to the DCP console using the failsafe URL (
[https://login.druva.com/?failsafe=True](https://login.druva.com/?failsafe=True)) with the backup credentials.Test administrator login for newly created
@new-domain.comaccounts via standard SSO once the domain cutover is executed by the Identity Provider.