PGV UPN Prefix

In addition to what Johnny said, you can also use the PGV policy to set spaces as a restricted character. It will automatically remove the space from the generated UPN.

support.oneidentity.com/.../configure-user-logon-name-generation-policy-to-exclude-empty-space

This will work IF the UPN is based off the samaccountname as that is what this policy is responsible for generating.

Thanks as Johnny has said this only works with SamAccountName. 

The one issue i have with the Change workflow. I dont want our Service Desk to get all the way to the end of the new user process to then be told or it fail. There is a lot of steps and check boxes they need to set. I need figure out a way of this alerting asap in the process. 

Another way to tackle this is using a policy script that implements an onGetEffectivePolicy handler that basically continuously checks to see if a surname containing a space has been entered and then throws an error if a bad surname has been supplied.  Unfortunately, I don't believe you can generate the warning until the operator hits "next" on the page where they entered the surname.  You could also just have the script apply logic to get rid of the space in the UPN.  Unfortunatley, The UPN attribute is a somewhat tricky attribute to apply policy to because out-of-the-box, it's constructed from edsvaUPNPrefix and edsvaUPNSuffix.

I may also be overthinking this.

Seeing the warning only when they hit next is fine. The UPN is on the very first page of our new user process. So that would work. 

we only use scripts so im sure we do have some things like this also. Like Johnny said its not easy to throw warnings in gui but you can apply logic, for example we have the same upn policy and we leave given name and sn default because the given name writing might not be wrong but cant be used in mail or upn. so you just take the values from reqeust, remove special charcters and set UPNprefix and Suffix. 

If you use Web GUI you can add Text to the form so if this part need some special explanation this might be the place, because most peopel try first and then read docus which are located somewhere else

we only use scripts so im sure we do have some things like this also. Like Johnny said its not easy to throw warnings in gui but you can apply logic, for example we have the same upn policy and we leave given name and sn default because the given name writing might not be wrong but cant be used in mail or upn. so you just take the values from reqeust, remove special charcters and set UPNprefix and Suffix. 

If you use Web GUI you can add Text to the form so if this part need some special explanation this might be the place, because most peopel try first and then read docus which are located somewhere else