I am facing an issue while provisioning accounts in Active Directory (AD) using SailPoint IdentityNow. Only the Account ID (DN) and Account Name (sAMAccountName) are getting mapped successfully, but all other attributes are coming in blank in AD.
Current Setup:
DN → Mapped to ID
sAMAccountName → Mapped to Account Name
Other attributes (e.g., Title, Department, ManagerDN) are not getting populated
I have mapped all required attributes in the Create Account provisioning policy
Even static values set for attributes are showing as blank in AD
Troubleshooting Done:
Verified attribute mappings in Create Account policy Confirmed that the attributes exist in the Account Schema Checked the provisioning logs, but no errors related to attribute mapping Ran a test by setting a static value, but the attribute still remains blank
Questions:
Why are only Account ID and Account Name getting provisioned while other attributes remain blank?
Are there any additional configurations needed to ensure all attributes are populated in AD?
Would appreciate any insights or troubleshooting steps.
Does the AD service account have read permission to those attributes? (e.g. How was the service account configured with the required permissions?) …Is there any specific ACL in the environment preventing the read of those attributes? You have a hardened AD environment?
“but the attribute still remains blank” → Where are you seeing them as blank? ADUC (?), what is it running as?
You get this behavior usually when you are supplying an invalid value to an attribute at AD or the AD service account doesn’t have permission to set some attribute(s).
It might be a good idea to use the service account and test creating an account in PowerShell, that might give you an idea if it’s a permissions issue.
It might also be a good idea to adjust the order of attributes in the create policy, because if one attribute is failing like @KRM7 said, the rest of the attributes won’t populate. Start with ones you know work without error, then simple ones, etc.
Verified attribute mappings in Create Account policy