PowerCLI login to vCenter fails with upn@domain when VCF SSO configured with Active Directory (AD)

VMware vCenter Server VCF Operations VMware Cloud Foundation

VCF SSO is directly configured to Active Directory
Login with SSO user and domain credentials works as expected for vCenter web UI
Login through Powershell SDK with Connect-VIServer cmdlet fails with

Cannot complete login due to an incorrect user name or password.
After attempted login with Powershell SDK the following is seen in VCF Operations logs

ERROR vmidentity-sts ## [vc@### threadName="tomcat-http--2" logger="com.vmware.identity.idm.server.IdentityManager" corId="########-####-####-####-############"] Failed to authenticate principal [user@domain] for tenant [vsphere.local]"

VCF Operations 9.1.X

vCenter 9.1.X

VCF 9.1.X

The web user interface (UI) utilizes VIDB to process authentication and authorization
API and PowerCLI authentication and authorization utilizes vCenter for processing
vCenter only accepts logins whose domain suffix matches what's registered for the customer's identity source; a login format that doesn't match that expected suffix is rejected before ever reaching Active Directory - this is a vCenter-side limitation.

Log in to vCenter with PowerCLI needs the following format:

<username>@<upn-domain>@<login-domain>

Example:

userPrincipalName - [email protected]

UPN domain- rainpole.com

Login domain - rainpole.local

In the above scenario login will be successful using [email protected]@rainpole.local

If you are utilizing this method for a previously created service account in AD:

Log into VCF Operations and go to 'Manage > Identity & Access'
Open the IDB settings, go to the Identity Source tab, and then edit the directory config
Add the service account to 'User Provisioning' and Sync
In vCenter, remove the account/role already defined for that service account and re-add it
Attempt connection with PowerCLI using the <username>@<upn-domain>@<login-domain> format