Anyone here worked with alternate UPN suffixes sync'd to Entra ID? Could really use your help confirming what I'm about to test works!

My objective is to stand up a new, parallel AD DS on a new, separate cluster from the old, and have this new AD DS sync identities and objects to a new Entra tenant (gcc high) using Entra Connect Sync. I also need to continue using my root DNS domain (contoso.com) on the new tenant after unhooking it from the old commercial tenant.

I'm jumping through all these hoops because Entra won't allow two domains to be verified and sync'd in two tenants simultaneously. I need time with the new ADDS/new tenant to configure and test hybrid device policies

1. Allow old ADDS to continue running, syncing identities (contoso.com) to commercial tenant up until cutover

2. Build new ADDS using a subdomain (ad.contoso.com), and sync new identities to new gcc high tenant

3. On cutover weekend, remove (contoso.com) from commercial tenant, and orphan identities in commercial tenant making them cloud accounts

4. On cutover weekend, verify (contoso.com) in the new tenant (gcc high)

5. On cutover weekend, add an alternative suffix to the new ADDS (contoso.com), and flip all the new identities to use the new UPN suffix (contoso.com)

6. Allow propagation of changes

7. BitTitan-transfer orphaned cloud data in the commercial tenant to corresponding/appropriate hybrid Identities in the new gcc high tenant.

I'm really hopeful that this checks out with someone who's been down a similar path and knows some of the nuances surrounding these decisions.

If anyone can help confirm or deny that these steps will result in success, I'd be so appreciative!