Email Address Changes

Best practices for handling end-user email changes in bulk

Handling Email Changes for SSO Users

Organizations may need to migrate users to a new email domain, such as during a merger or acquisition. For users authenticating via Single Sign-On (SSO), their email address serves as the primary identifier in both the Identity Provider (IdP) and Keeper. If the email addresses do not match, authentication will fail. To prevent disruptions, email changes must be properly coordinated between both systems.

Recommended Process for Administrators

To ensure a seamless transition when updating user email addresses in bulk, Keeper recommends using Keeper Commander (CLI Tool) before making changes in the IdP. This approach maintains authentication continuity and minimizes user impact.

Updating User Emails with Keeper Commander

• Reserve the New Email Domain Ensure the new domain is reserved for your enterprise. If not, contact Keeper Support to enable it before proceeding.

• Download Keeper Commander Get the latest release: Keeper Commander Releases

• Update User Emails Run the following command to change an email address:

  eu --add-alias [e-mail] [e-mail]

  • This command updates the primary email while retaining the old email as an alias.

  • Reference: Enterprise User (eu) Command

• Batch Processing for Multiple Users

  • Create a batch file with multiple commands for bulk updates.

  • Test with one user before applying changes to all.

  • Guide: Keeper Commander Batch Commands

• Sync Keeper SSO Connect (If Applicable) If using Keeper SSO Connect On-Prem, sync the SSO Connect server to apply the updates.

• Update Emails in the IdP Once emails are updated in Keeper, proceed with updating them in the IdP.

---

Alternative Process: User Updates Their Own Email

Users can manually update their Keeper email, but this must be coordinated to avoid authentication issues. Before proceeding, ensure that role-based enforcement does not prevent email changes.

Steps for Users to Update Their Email

1. Log in to Keeper using the current email address.

2. Administrator updates the email in the IdP.

3. User updates email in Keeper:

   • Navigate to Settings > General > Email Address - Reset Now.

   • A confirmation email will be sent to the new email address.

   • Click the link in the email to confirm the update.

4. Sync Keeper SSO Connect (If Applicable)

---

Bulk Email Changes

If multiple users require email updates, please contact Keeper Support for assistance in coordinating these updates efficiently.