Hi, I’m experiencing the following error message while trying to create samaccountname in AD. I created a custom tranform that calculates different patterns for samaccountname. I’m currently testing the transform for identities with the same name but it seems that its only calculating the first pat…

Ok, I think I know why this isn’t working. The username generator transform only works on the attribute that is marked as the account ID in the attribute schema. The way it works, I believe, is it tries to provision an account using each pattern in the list until one succeeds. If the provision fa…

Hi Alex, To properly configure the unique counter, you need to include the attribute cloudMaxUniqueChecks to tell IDN how many numbers patterns to try before giving up. Please see this example from an AD source that I have setup in my tenant for an idea of how to do it. You can also read more abo…

I just realized that you do have cloudMaxUniqueChecks specified. What you have is a very complicated create provisioning transform. Pinpointing where this is failing could take some work. Maybe you can try creating a new identity attribute called “Preferred Display Name”, and then use that in you…

I’m not entirely sure. It looks like the standard approach to creating a samaccountname is the code I shared above, which references a custom rule called “Create Unique LDAP Attribute”. It looks like that rule can only accept identity attributes, which is why I suggested you create the preferred d…

We want to be able to create different patterns here when creating the account. For example, firstname initial and full lastname, first two characters of firstname and lastname etc. Is this possible?

It should be. I haven’t tried to do that myself. Maybe you can try doing a simpler username generator transform just to see if you can get it to work, then slowly add back your business requirements until you get the result you want.

Is your generator only supposed to use first name initials? Why does the error message show the full first name? CN=John Doe1

for the distinguished name we are calculationg preferreddisplayname as following: CN = John Doe1, OU=testing, DC=Test, DC=testing, DC=Test which is unique. The error is occurring because the samaccountname already exist at the target so it’s not calculating the second pattern I specified in the gene…

If I use the generator on accountid which in this case is the distinghishedname I can calculate the different patterns successfully. Is it possible create a regex transform on the samaccountname and fetch the values from the distinghishedname?

Thanks Collin, this is very helpful. So in this case we have to use the attribute generator rule. Do you have an example.

AD Account Creation Error

Identity Security Cloud (ISC) ISC Discussion and Questions

adyer (Alex Dyer) May 9, 2023, 6:17pm 6

Can you use the account generator to create samaccountname?

Active Directory Provisioning Error via IQService – ENTRY_EXISTS for CN/DN, but the user does not exist in AD

Topic		Replies	Views
AD Create Account - sAMAccountName not unique ISC Discussion and Questions identity-security-cloud , provisioning	12	409	June 15, 2025
Getting a transform for AD Samaccountname ISC Discussion and Questions transforms , rules , identity-security-cloud , provisioning	1	126	February 10, 2025
Getting error during create account for AD ISC Discussion and Questions transforms , identity-security-cloud , provisioning	10	928	April 22, 2024
Error when adding identities to an Active Directory source ISC Discussion and Questions identity-security-cloud , provisioning , accounts	9	231	July 18, 2024
Unable to provision new accounts in AD ISC Discussion and Questions identity-security-cloud , provisioning	21	203	June 3, 2025

AD Account Creation Error

Related topics