Explanation/Reference:
Explanation:
The domain we want to federate must be registered as a public internet domain with a domain registrar or within our own public DNS servers. We cannot use contoso.local as it is not routable outside of the intranet. We can then use Active Directory Domains and Trusts to add user principal name (UPN) suffixes to the domain. The default UPN suffix is the Domain Name System (DNS) domain name of the contoso.local domain that contains the user account. We can add contoso.com as an alternative UPN suffixes for logon processes.
We should then use Active Directory Users and Computers to change the UPN of user accounts in the specified departments to contoso.com.
Finally, we can use user attribute-based filtering to exclude all have non-routable domain names, i.e., those that have a contoso.local as their UPN suffix.