CN Change in Active Directory Without Cloud Rule

[torry_salamat]

Hello Community,

I’m working on an Active Directory source, and I need to handle a use case where the CN (and therefore the DN) of an account must be updated whenever an identity’s firstname or lastname changes.

I understand that AC_NewName can be used to rename the CN and AC_NewParent to move the object, but I’m constrained by the fact that I cannot use Cloud Rules due to budget limitations.

My question is whether it is a reliable and recommended approach to use a Before Provisioning Connector Rule to detect the change, compute a new CN , and set AC_NewName and AC_NewParent or if this is not the right pattern in ISC. Alternatively, would it be better to rely on Attribute Sync combined with the Update Provisioning Policy to populate AC_NewName directly?

Many thanks,

[utkirjonkamiljanov]

Please let me know if you find this link helpful:

A Robust Design Pattern for Handling Legal Name Changes and AD Attribute Synchronization

Problem How to Handle End to End “Name Change“ flow in Active Directory which could lead to CN Change, Mail Change, UPN Change, CN Change? Due to Multiple Complexities involved its not straight forward. Diagnosis In order to perform the Name Change Flow, we need to use combination of components in SailPoint ISC in order to perform it successfully. The high level details are. We need to create an identity attribute such as “Display Name History“ which will store the value of OLD Display Name p…

[marcmcgee]

I have had great luck with multiple clients leveraging the Services Standard Before Provisioning Rule . Using configuration patterns to accomplish the name change as well as other common AD behaviors. It can also be leveraged with some other connectors, but a number of the functions are for AD. Getting it deployed on my clients’ tenants was relatively painless, just taking a request ticket. Depending on the subscription you have, deployment of cloud rules may be included, you will have to verify with your account representative. I hope you are able to find what you are looking for.

I have leveraged some of the other immutable unique ids on AD to create a secondary correlation attribute by pulling in the unique ID into the identity through the profile, then leveraging that to correlate. It is also the same ID I’ve seen used with Entra hybrid account syncs, so you can leverage that ID to find the corresponding Entra account as well.

[j_place (Jeremy Place)]

Hi @torry_salamat

From what I know, some people have successfully used a Provisioning Policy of UPDATE usage type, to set the AC_NewName attribute. However, from https://community.sailpoint.com/t5/Identity-Security-Cloud-Wiki/Best-Practices-Active-Directory-Account-Moves/ta-p/189661:

It is not recommended to go through the account profiles because attributes set there go through a verification stage after provisioning. Since AC_NewParent and AC_NewName are not read via the connector, they can never be verified. This results in “stranded” account activity entries within the IdentityNow tenant.

Also, Cloud Rule is the only avenue that I know of, because ISC needs to know the value of AC_NewName to re-aggregate the new Account ID. If a connector rule was used, ISC would not be aware of the use of the special attribute.

[PhilRawlings1 (Phil Rawlings)]

We have never successfully implemented the automation of what you are asking.
Changing those values - in all my installs - have involved CN, sAMAccountName, UPN, email, etc

Its generally a low usage case and ultimately easier to do as a manual intervention