I have had great luck with multiple clients leveraging the Services Standard Before Provisioning Rule . Using configuration patterns to accomplish the name change as well as other common AD behaviors. It can also be leveraged with some other connectors, but a number of the functions are for AD. Getting it deployed on my clients’ tenants was relatively painless, just taking a request ticket. Depending on the subscription you have, deployment of cloud rules may be included, you will have to verify with your account representative. I hope you are able to find what you are looking for.
I have leveraged some of the other immutable unique ids on AD to create a secondary correlation attribute by pulling in the unique ID into the identity through the profile, then leveraging that to correlate. It is also the same ID I’ve seen used with Entra hybrid account syncs, so you can leverage that ID to find the corresponding Entra account as well.