Hello, I am trying to have provisioning setup so that property msExchHideFromAddressLists is set to true during Disable Account provisioning and set to during Enable Account provisioning, however I cannot clear the value the life of me. True and False get successfully written to AD but clearing it…

Since the attribute type is boolean, I don’t think you can have null values. If you can make use of Before Provisioning Rule or Native Rule (After Modify Rule) with PowerShell script, you can implement.

Is this setup in your Create provisioning policy? if so, it only applies when an account is created and not during attribute sync which is what you may want. I’d recommend and have done this by having an Identity attribute with the true/false value needed and then enable attribute sync on that attr…

ENABLE : msExchHideFromAddressLists - “” DISABLE : msExchHideFromAddressLists - true CREATE : msExchHideFromAddressLists - “” It starts empty by default because thats its default value in AD, but I cannot set it empty again.

I am not sure if you can do it using IDN provisioning policy but you should be able to set the ‘msExchHideFromAddressLists’ attribute to empty/null using PowerShell something like below - Set-ADObject -Identity <AD DN> -Clear msExchHideFromAddressLists Above PowerShell cmdlet can be trigger based …

Like Krishna Reddy Mummadi said you can’t set it to null. you just need to flip between true and false. If its never been set then it is null which evaluates to false. Once you set to true to hide a mailbox, you then set to false to unhide it. you don’t need to clear it.

I did, however now I have another problem. When someone disables/enables an account outside of IDN, the attribute isnt updated. I need to add provisioning of the attribute on UPDATE but I need to know whether the account is enabled. How would I check that in a provisioning policy?

@lukas_ceremeta - You may implement Native change detection detects when accounts have been created, updated, or deleted out-of-band. You can use native change detection to remediate incidents where accounts are changed or entitlements are assigned outside the Identity Security Cloud. You can set u…

I do not have an HTTP server set up for this. Is it really not possible to check whether an account is enabled/disabled inside a transform/provisioning policy ?

How to clear boolean attribute during provisioning for Active Directory

Identity Security Cloud (ISC) ISC Discussion and Questions

lukas_ceremeta (Lukas Ceremeta) January 11, 2024, 8:22am 5

I wonder if changing it to a string on sailpoints side would allow me to work around this.

Topic		Replies	Views
Disable Provisioning policy ISC Discussion and Questions identity-security-cloud , provisioning	10	287	September 30, 2025
Enable Provisioning policy not clearing extensionAttribute ISC Discussion and Questions transforms , identity-security-cloud , provisioning	6	631	December 17, 2023
Blank Attribute in Provisioning Policy ISC Discussion and Questions identity-security-cloud , provisioning	3	376	December 31, 2023
Set Attribute Value to Null as part of Leaver Process ISC Discussion and Questions identity-security-cloud	2	34	March 29, 2026
DISABLE Provision Policy update the accountExpires attribute in AD ISC Discussion and Questions identity-security-cloud , provisioning	9	165	June 10, 2025

How to clear boolean attribute during provisioning for Active Directory

Related topics