We have a company internal server that users need to be a part of A/D to log in. However I want users to be able to add an external account for notifications should they not have a company supplied email address. I found that they have two options, they can either change the primary or add a secondary, the problem is that if they change the primary and they go to log in again it will create a new account because the other email that it was created with isnt used anymore, creating duplicate accounts. However, if I turn off the ability to not change the email address they cannot add an alternate email.
I am wondering if there is a way to allow users to add a secondary email but not be allowed to change their primary email address?