Hello Team,
Active Directory PTA is being used to perform AD cleanup activities. At present, PTA does not support updating AD attributes, resulting in process limitations and roadblocks where user attribute modifications are required but not available through the platform.
regards,
renga
Hello Renga,
You can invoke a powershell script!
@rengarajan75 PTA works well for AD cleanup activities, but the main limitation here is that it doesn’t support updating AD user attributes.
So, if your cleanup activity only involves removing or managing access, PTA can handle it. But if the same process also requires changing attributes like department, manager, employee type, description, etc., you’ll need another mechanism outside PTA to make those changes in AD.
If attribute updates are a regular part of your cleanup process, you may need to handle them through SailPoint provisioning, PowerShell, or another automation method rather than relying only on PTA.
Hello Rengarajan. You are right that the native PTA Active Directory action currently has no general command for updating user attributes. SailPoint added update_group_attributes for AD groups and support for searching users by extension attributes 1-15, but there’s still no equivalent update_user_attributes command.
As @YanCoelho mentioned, you can work around this within PTA by using Windows Server > Execute PowerShell Script and calling Set-ADUser. The script must be stored locally on the target Windows server, the Active Directory PowerShell module must be available, and the execution account needs the appropriate delegated permissions.
Both NTLM and Kerberos are supported. However, if AD cmdlets fail under NTLM because of credential delegation or the PowerShell double-hop, Kerberos may be required for that setup.
For attributes governed from identity data, such as department or title, Attribute Sync is usually the cleaner approach. The AD account attribute must be included in the source’s Create Account definition and mapped directly from an identity attribute. Manager synchronization requires a custom identity attribute because the built-in Manager attribute is not eligible for Attribute Sync.
For one-time cleanup activities or attributes outside the identity model, PowerShell through PTA is probably the most practical current workaround.