Manu is correct you need a .com on the external Azure FQDN and another UPN added to your internal domain that matches the external .com.