On our AD source, custom AttributeGenerator cloud rules show up fine in the Generator dropdown under the standard Create Account provisioning policy.
However, under the new Machine Account Creation feature (Account Subtype > Account Creation > Attribute Mapping), the Generator dropdown for the same attributes (e.g. distinguishedName) only lists the built-in generators — Create Unique LDAP Attribute and Create Unique Account ID. Our custom cloud rules don’t appear there.
Is this expected/by design for this new feature, or a current gap that’s planned to be addressed?
Hello Fatima, I think this is a current gap in the Machine Account Creation feature. It just went GA on June 16, 2026, so the Attribute Mappings UI under Account Subtypes > Account Creation is its own separate implementation and doesn’t pull in custom AttributeGenerator cloud rules the way the standard Create Account provisioning policy does.
If you look at the docs for Machine Account Creation attribute mappings, the Generator option is described generically without any mention of custom cloud rules. Compare that with the standard Create Account docs, which explicitly say “To add generators to the list, your implementation team can create Attribute Generator rules.” That distinction tells you it’s not wired up yet on the machine account side.
For a workaround, you could try using the Static option with Velocity syntax to build the distinguishedName (something like CN=${userInput.accountName},OU=ServiceAccounts,DC=example,DC=com if the form collects the account name). That works for straightforward patterns.
For complex logic or uniqueness checks, I would raise a SailPoint Support case and also submit an Idea for custom generator support.