How to clear manager DN from an AD account?

Identity Security Cloud (ISC) ISC Discussion and Questions
, ,
1

Hi. I have a demand where an identity that is dismissed must clear his manager on AD. I have configured a provisioning policy with a transform that sets manager attribute to “” when user is leaving organization, but it does not reflect on AD.

I found an entry here that established that connector needs a valid DN (an empty value will not change manager in fact), Clear ‘Manager’ and ‘ManagerDN’ identity attributes for inactive users - #19 by Rich_Miller

as post has about 3 years, I does not know if it was fixed or is this behaviour is still actual. Anybody can tell? Thanks!

2

The Active Directory connector still requires a valid Distinguished Name (DN) when updating the manager attribute. If you send an empty string ("") or null, the connector does not clear the manager field—it simply skips the update. This is by design, because AD schema validation rejects blank DNs.

So, even though your provisioning policy transform sets manager to "", the connector interprets that as “no change.”

Ways to Clear the Manager

  1. Use ProvisioningPlan.Operation.Remove with null
    In a Before Provisioning Rule, explicitly remove the attribute:
new AttributeRequest("manager", ProvisioningPlan.Operation.Remove, null);

This tells the connector to clear the value instead of setting it to empty.
2. Clear both manager and managerDN If your identity model includes both attributes, remove both:

plan.add(new AttributeRequest("manager", ProvisioningPlan.Operation.Remove, null));
plan.add(new AttributeRequest("managerDN", ProvisioningPlan.Operation.Remove, null));
  1. Use a Before Provisioning Rule instead of a transform
    Transforms can’t issue a Remove operation—they only set values. The rule approach ensures the connector sends a proper, clear instruction to AD.
3

Hi @Santhakumar thanks for your confirmation. Actually I have an after operation rule whith clears the manager with powershell:
Set-ADUser -Identity $nativeIdentity -Clear manager

is actually working but it was desired to get a more “configurable” way. With this confirmation I can move on, thanks!