Hi, I am currently working on a project in IdentityNow in which I have to configure the provisioning of Active Directory accounts based on the Lifecycle State of an identity. I have set up the configuration in the Identity Profile ‘Provisioning’ tab. However, I am running into the following issue d…

Hi Aishwarya, I ended up being able to resolve the issue by creating a new AD connector with the same configuration as the old one. Not entirely sure why that solved it, but give it a try.

Hi @rpalivela Welcome to SailPoint developer community. In your provisioning policy, there will be Object Type attribute by default, configure the same as below. [image] Thanks Krish

Is ootb connector or have you customized something? Can you share the create provisioning policy?

Hi Krish, Thank you for your response. It is already configured like that when the issue is happening.

Hi Julian, Some things have been customized, namely custom transforms for the distinguishedName, sAMAccountName, and initial AD password, as well as some extra attributes that are copied directly from the identity profile mappings. My configuration for the ObjectType is exactly what Krish posted i…

No need of JSON, just get us the screenshots of create account provisioning policy from UI. I guess you copied some attributes definition and pasted in create account policy. As per the error, there is an attribute User in your create account provisioning policy form, it configured as required in …

My confusion is that there is no attribute ‘User’ as such except for the following: [image]

OK, can you get us the account request by masking sensitive data. You can find that in search. Just search with user account id, you can find under Account Activity. We can see what are values are passing.

The problem is with the format you used to generate DN. You are using firstName, middleInitial, Lastname and dnOU identity attributes. Check if user doesn’t has value for any attribute. That might help you to understand the issue. Thanks Krish

I have checked and the user is correctly receiving a first name, middle initial, last name, and OU in the identity profile. Is there anything else that could be the issue? I have a list of 4 patterns and it is failing at the last pattern, meaning the previous patterns are failing due to non-uniquene…

Active Directory Create Account failing because of undefined required string attribute 'User'

Identity Security Cloud (ISC) ISC Discussion and Questions

rpalivela (Rithwik Palivela) December 11, 2023, 4:14pm 9

Here is what it is showing under Events (Account Activity is just showing that the identity was successfully created):

Topic		Replies	Views
Required string attribute 'User' is not defined ISC Discussion and Questions transforms , identity-security-cloud , provisioning	5	100	September 1, 2025
Missing attribute value when creating AD account by adding AD entitlements ISC Discussion and Questions identity-security-cloud , provisioning	8	131	January 11, 2026
Usernamegeneration ISC Discussion and Questions transforms , identity-security-cloud , provisioning	20	541	September 14, 2024
Adding a specific attribute breaks provisioning in Active Directory ISC Discussion and Questions identity-security-cloud , access-requests , ootb-connector	5	195	February 17, 2025
AD Connector as Target ISC Discussion and Questions identity-security-cloud , provisioning	22	249	June 2, 2025

Active Directory Create Account failing because of undefined required string attribute 'User'

Related topics