Hi, I’m experiencing the following error message while trying to create samaccountname in AD. I created a custom tranform that calculates different patterns for samaccountname. I’m currently testing the transform for identities with the same name but it seems that its only calculating the first pat…

Ok, I think I know why this isn’t working. The username generator transform only works on the attribute that is marked as the account ID in the attribute schema. The way it works, I believe, is it tries to provision an account using each pattern in the list until one succeeds. If the provision fa…

Hi Alex, To properly configure the unique counter, you need to include the attribute cloudMaxUniqueChecks to tell IDN how many numbers patterns to try before giving up. Please see this example from an AD source that I have setup in my tenant for an idea of how to do it. You can also read more abo…

I just realized that you do have cloudMaxUniqueChecks specified. What you have is a very complicated create provisioning transform. Pinpointing where this is failing could take some work. Maybe you can try creating a new identity attribute called “Preferred Display Name”, and then use that in you…

Can you use the account generator to create samaccountname?

I’m not entirely sure. It looks like the standard approach to creating a samaccountname is the code I shared above, which references a custom rule called “Create Unique LDAP Attribute”. It looks like that rule can only accept identity attributes, which is why I suggested you create the preferred d…

We want to be able to create different patterns here when creating the account. For example, firstname initial and full lastname, first two characters of firstname and lastname etc. Is this possible?

It should be. I haven’t tried to do that myself. Maybe you can try doing a simpler username generator transform just to see if you can get it to work, then slowly add back your business requirements until you get the result you want.

Is your generator only supposed to use first name initials? Why does the error message show the full first name? CN=John Doe1

for the distinguished name we are calculationg preferreddisplayname as following: CN = John Doe1, OU=testing, DC=Test, DC=testing, DC=Test which is unique. The error is occurring because the samaccountname already exist at the target so it’s not calculating the second pattern I specified in the gene…

If I use the generator on accountid which in this case is the distinghishedname I can calculate the different patterns successfully. Is it possible create a regex transform on the samaccountname and fetch the values from the distinghishedname?

Thanks Collin, this is very helpful. So in this case we have to use the attribute generator rule. Do you have an example.

AD Account Creation Error

Identity Security Cloud (ISC) ISC Discussion and Questions

colin_mckibben (Colin McKibben) May 9, 2023, 8:32pm 15

I recommend using the UI to configure it. You can select the rule from the drop-down as shown in the image above.

Topic		Replies	Views
AD Create Account - sAMAccountName not unique ISC Discussion and Questions identity-security-cloud , provisioning	13	359	August 14, 2025
Getting a transform for AD Samaccountname ISC Discussion and Questions transforms , rules , identity-security-cloud , provisioning	2	109	April 18, 2025
Getting error during create account for AD ISC Discussion and Questions transforms , identity-security-cloud , provisioning	11	887	June 21, 2024
Error when adding identities to an Active Directory source ISC Discussion and Questions identity-security-cloud , provisioning , accounts	10	196	September 16, 2024
Unable to provision new accounts in AD ISC Discussion and Questions identity-security-cloud , provisioning	22	188	August 2, 2025

AD Account Creation Error

Related topics