# In entra create provisioning policy, for userPrincipal name and mail nickname i used usename Genearor

**URL:** <https://developer.sailpoint.com/discuss/t/in-entra-create-provisioning-policy-for-userprincipal-name-and-mail-nickname-i-used-usename-genearor/209458>\
**Category:** SHF Discussion and Questions\
**Tags:** provisioning, identity-security-cloud\
**Created:** [May 20, 2026, 5:00am UTC](https://developer.sailpoint.com/discuss/t/in-entra-create-provisioning-policy-for-userprincipal-name-and-mail-nickname-i-used-usename-genearor/209458 "2026-05-20T05:00:36Z")\
**Posts on this page:** 12\
**Page:** 1

<div class="post-metadata">

**Author:** ![ravikumar7284](https://avatars.discourse-cdn.com/v4/letter/r/bc8723/32.png) [@ravikumar7284](https://developer.sailpoint.com/discuss/u/ravikumar7284)\
**Post date:** [May 20, 2026, 5:00am UTC](https://developer.sailpoint.com/discuss/t/in-entra-create-provisioning-policy-for-userprincipal-name-and-mail-nickname-i-used-usename-genearor/209458/1 "2026-05-20T05:00:36Z")

</div>

> Hi Team, In Entra source create account provisioning policy, User principal name, mail nick name attributes used username generator. But when i tried identity peocessing it is failed. I will attach the usename genearator transform. Please suggest any issue with the code. The UPN output would be ADM+Firstletter of firstname+lastname@domainname, same for mailnickname also ADM+Firstletter of firstname+lastname.
> 
> {  
> “name”: “userPrincipalName”,  
> “transform”: {  
> “type”: “usernameGenerator”,  
> “attributes”: {  
> “template”: “ADM$(firstInitial)$(lastname)$(uniqueCounter)@chubbfsadmin.co.uk”,  
> “patterns”: [  
> “ADM$(firstInitial)$(lastname)@chubbfsadmin.co.uk”,  
> “ADM$(firstInitial)$(lastname)$(uniqueCounter)@chubbfsadmin.co.uk”  
> ]  
> },  
> “firstInitial”: {  
> “type”: “substring”,  
> “attributes”: {  
> “input”: {  
> “type”: “identityAttribute”,  
> “attributes”: {  
> “name”: “firstname”  
> }  
> },  
> “begin”: 0,  
> “end”: 1  
> }  
> },  
> “lastname”: {  
> “type”: “identityAttribute”,  
> “attributes”: {  
> “name”: “lastname”  
> }  
> }  
> },  
> “attributes”: {},  
> “isRequired”: true,  
> “type”: “string”,  
> “isMultiValued”: false  
> },
> 
> ![image](https://global.discourse-cdn.com/sailpoint/original/3X/8/1/817b8283f4b96a573719df392c37bdb1bc28c9cc.png)

---

<div class="post-metadata">

**Author:** ![Santhakumar](https://sea1.discourse-cdn.com/sailpoint/discuss/user_avatar/developer.sailpoint.com/santhakumar/32/17329_2.png) [@Santhakumar](https://developer.sailpoint.com/discuss/u/Santhakumar)\
**Post date:** [May 20, 2026, 5:15am UTC](https://developer.sailpoint.com/discuss/t/in-entra-create-provisioning-policy-for-userprincipal-name-and-mail-nickname-i-used-usename-genearor/209458/2 "2026-05-20T05:15:24Z")

</div>

@ravikumar7284 Can I know what type of error you are getting when doing the identity processing?

---

<div class="post-metadata">

**Author:** ![ravikumar7284](https://avatars.discourse-cdn.com/v4/letter/r/bc8723/32.png) [@ravikumar7284](https://developer.sailpoint.com/discuss/u/ravikumar7284)\
**Post date:** [May 20, 2026, 5:31am UTC](https://developer.sailpoint.com/discuss/t/in-entra-create-provisioning-policy-for-userprincipal-name-and-mail-nickname-i-used-usename-genearor/209458/3 "2026-05-20T05:31:00Z")

</div>

Now manual identity processing passed, after changing the code. But create account failed. Please find the updated code. please suggest any modification required.  
{  
“name”: “userPrincipalName”,  
“transform”: {  
“type”: “usernameGenerator”,  
“attributes”: {  
“sourceCheck”: true,  
“patterns”: [  
“ADM$(firstInitial)$(lastname)@chubbfsadmin.co.uk”,  
“ADM$(firstInitial)$(lastname)$(uniqueCounter)@chubbfsadmin.co.uk”  
],  
“firstInitial”: {  
“type”: “substring”,  
“attributes”: {  
“input”: {  
“type”: “identityAttribute”,  
“attributes”: {  
“name”: “firstname”  
}  
},  
“begin”: 0,  
“end”: 1  
}  
},  
“lastname”: {  
“type”: “identityAttribute”,  
“attributes”: {  
“name”: “lastname”  
}  
}  
}  
},  
“attributes”: {  
“cloudMaxSize”: “100”,  
“cloudMaxUniqueChecks”: “5”,  
“cloudRequired”: “true”  
},  
“isRequired”: true,  
“type”: “string”,  
“isMultiValued”: false  
},

 ![image](https://global.discourse-cdn.com/sailpoint/original/3X/1/f/1f3a7fd4bf705f7daac9cd8ffd3f49021616f203.png)

---

<div class="post-metadata">

**Author:** ![punna0001](https://sea1.discourse-cdn.com/sailpoint/discuss/user_avatar/developer.sailpoint.com/punna0001/32/42011_2.png) [@punna0001](https://developer.sailpoint.com/discuss/u/punna0001)\
**Post date:** [May 20, 2026, 5:32am UTC](https://developer.sailpoint.com/discuss/t/in-entra-create-provisioning-policy-for-userprincipal-name-and-mail-nickname-i-used-usename-genearor/209458/4 "2026-05-20T05:32:01Z")

</div>

Hello Ravi, I saw the same question with this transform in one of the groups, so I think I know what’s going on here. There are three things in the JSON that need fixing, and any one of them alone will break the transform.

1. `firstInitial` and `lastname` are sitting in the wrong place. Move them inside the `attributes` block, next to `patterns`. Right now they’re outside, so the generator can’t find them.

2. The placeholder syntax is wrong. Use `$firstInitial` and `$lastname`, not `$(firstInitial)` and `$(lastname)`. For `uniqueCounter`, use curly braces: `${uniqueCounter}`.

3. Drop the `template` line. `usernameGenerator` only uses `patterns`. Also, keep `${uniqueCounter}` only in the last pattern, since the generator stops there.

Here’s the corrected JSON:

```auto
{
  "name": "userPrincipalName",
  "transform": {
    "type": "usernameGenerator",
    "attributes": {
      "sourceCheck": true,
      "patterns": [
        "ADM$firstInitial$lastname@chubbfsadmin.co.uk",
        "ADM$firstInitial$lastname${uniqueCounter}@chubbfsadmin.co.uk"
      ],
      "firstInitial": {
        "type": "substring",
        "attributes": {
          "input": {
            "type": "identityAttribute",
            "attributes": { "name": "firstname" }
          },
          "begin": 0,
          "end": 1
        }
      },
      "lastname": {
        "type": "identityAttribute",
        "attributes": { "name": "lastname" }
      }
    }
  },
  "attributes": {
    "cloudMaxSize": "100",
    "cloudMaxUniqueChecks": "5",
    "cloudRequired": "true"
  },
  "isRequired": true,
  "type": "string",
  "isMultiValued": false
}

```

Use the same structure for `mailNickname`, just remove `@chubbfsadmin.co.uk` from the patterns.

---

<div class="post-metadata">

**Author:** ![punna0001](https://sea1.discourse-cdn.com/sailpoint/discuss/user_avatar/developer.sailpoint.com/punna0001/32/42011_2.png) [@punna0001](https://developer.sailpoint.com/discuss/u/punna0001)\
**Post date:** [May 20, 2026, 5:35am UTC](https://developer.sailpoint.com/discuss/t/in-entra-create-provisioning-policy-for-userprincipal-name-and-mail-nickname-i-used-usename-genearor/209458/5 "2026-05-20T05:35:34Z")

</div>

![image](https://global.discourse-cdn.com/sailpoint/original/3X/7/6/76abc99ea2057f0f970f0f105873b634879fb5dc.jpeg)

Ravi, identity processing passed but look at the screenshot, the username being sent to Entra is literally `ADM$(firstInitial)$(lastname)@chubbfsadmin.co.uk`. The placeholders aren’t being replaced.

The syntax needs to be `$firstInitial` and `$lastname`, not `$(firstInitial)` and `$(lastname)`. Same fix for `mailNickname`. Update both patterns like this:

```auto
"patterns": [
  "ADM$firstInitial$lastname@chubbfsadmin.co.uk",
  "ADM$firstInitial$lastname${uniqueCounter}@chubbfsadmin.co.uk"
]

```

Save, then run identity refresh again. The username in the account request should now show as the actual generated value (something like `ADMAFellows@chubbfsadmin.co.uk`) instead of the raw placeholder text.

---

<div class="post-metadata">

**Author:** ![ravikumar7284](https://avatars.discourse-cdn.com/v4/letter/r/bc8723/32.png) [@ravikumar7284](https://developer.sailpoint.com/discuss/u/ravikumar7284)\
**Post date:** [May 20, 2026, 5:52am UTC](https://developer.sailpoint.com/discuss/t/in-entra-create-provisioning-policy-for-userprincipal-name-and-mail-nickname-i-used-usename-genearor/209458/6 "2026-05-20T05:52:45Z")

</div>

Thanks @punna0001 Issue resolved.

---

<div class="post-metadata">

**Author:** ![ravikumar7284](https://avatars.discourse-cdn.com/v4/letter/r/bc8723/32.png) [@ravikumar7284](https://developer.sailpoint.com/discuss/u/ravikumar7284)\
**Post date:** [May 20, 2026, 6:07am UTC](https://developer.sailpoint.com/discuss/t/in-entra-create-provisioning-policy-for-userprincipal-name-and-mail-nickname-i-used-usename-genearor/209458/7 "2026-05-20T06:07:46Z")

</div>

Hi Harish, even though user principal name and mail nick name processed correctly, After identity refresh, in events it shows create account failed. I ran account aggregation the account got created in entra, I tried another identity same create account failed, i ran account aggregation but account not pulled into entra source. It shoud be 16 accounts but only 15 accounts scanned.

 ![image](https://global.discourse-cdn.com/sailpoint/original/3X/5/4/546b6d96ddacbd728ec76de5622f9c214e98b4f3.png)

 ![image](https://global.discourse-cdn.com/sailpoint/original/3X/5/f/5f0b0eb79d9242af572fa5e1013d7905d71ecb68.jpeg)

 ![image](https://global.discourse-cdn.com/sailpoint/original/3X/1/9/1927189554cec1095a2cdcd36f22781fc7e12aec.jpeg)

---

<div class="post-metadata">

**Author:** ![Santhakumar](https://sea1.discourse-cdn.com/sailpoint/discuss/user_avatar/developer.sailpoint.com/santhakumar/32/17329_2.png) [@Santhakumar](https://developer.sailpoint.com/discuss/u/Santhakumar)\
**Post date:** [May 20, 2026, 6:21am UTC](https://developer.sailpoint.com/discuss/t/in-entra-create-provisioning-policy-for-userprincipal-name-and-mail-nickname-i-used-usename-genearor/209458/8 "2026-05-20T06:21:24Z")

</div>

Your nativeidentity is not populating correctly it seems.

---

<div class="post-metadata">

**Author:** ![punna0001](https://sea1.discourse-cdn.com/sailpoint/discuss/user_avatar/developer.sailpoint.com/punna0001/32/42011_2.png) [@punna0001](https://developer.sailpoint.com/discuss/u/punna0001)\
**Post date:** [May 20, 2026, 7:03am UTC](https://developer.sailpoint.com/discuss/t/in-entra-create-provisioning-policy-for-userprincipal-name-and-mail-nickname-i-used-usename-genearor/209458/9 "2026-05-20T07:03:11Z")

</div>

The generated value still has a problem. From your screenshot, SailPoint is sending

```auto
userPrincipalName: ADMGTest 1 Onboarding@chubbfsadmin.co.uk
mailNickname: ADMGTest 1 Onboarding

```

 ![image](https://global.discourse-cdn.com/sailpoint/original/3X/1/7/1709b5c086543a0926092609a284e9e5f2b6fa4b.jpeg)

See the spaces? That’s because your identity’s lastname is literally “Test 1 Onboarding”. Entra doesn’t allow spaces in `userPrincipalName` or `mailNickname`, so it rejects the request.

I assume this is just test data, easiest fix is to use a clean test identity. Try someone with firstname `John` and lastname `Smith`. Real users usually won’t have spaces or numbers in their lastname, so the policy doesn’t need to handle that. Once it works for a clean identity, you know the policy is good.

Later, if you want to handle edge cases like hyphenated names or apostrophes or extra spaces, you can add a `replaceAll` transform to clean up the lastname.

Account aggregation doesn’t create accounts in Entra. It only reads accounts from Entra back into ISC. If you see 15 instead of 16, it means the account was never created in Entra in the first place, because the create failed. So, clean up the test identity and run identity refresh again

---

<div class="post-metadata">

**Author:** ![ravikumar7284](https://avatars.discourse-cdn.com/v4/letter/r/bc8723/32.png) [@ravikumar7284](https://developer.sailpoint.com/discuss/u/ravikumar7284)\
**Post date:** [June 1, 2026, 12:32pm UTC](https://developer.sailpoint.com/discuss/t/in-entra-create-provisioning-policy-for-userprincipal-name-and-mail-nickname-i-used-usename-genearor/209458/10 "2026-06-01T12:32:53Z")

</div>

Hi @punna0001  
Need help, Why the values not evaluating here. The requirement is firstname as users firstname, lastname as users last name.

 ![image](https://global.discourse-cdn.com/sailpoint/original/3X/b/7/b7cf64ae00e8e77f0215ba8a89b91abb6f2d68f1.jpeg)

 ![image](https://global.discourse-cdn.com/sailpoint/original/3X/6/3/63c7b6530c193c49fa42299731affd6df7d53f61.png)

---

<div class="post-metadata">

**Author:** ![ravikumar7284](https://avatars.discourse-cdn.com/v4/letter/r/bc8723/32.png) [@ravikumar7284](https://developer.sailpoint.com/discuss/u/ravikumar7284)\
**Post date:** [June 1, 2026, 12:34pm UTC](https://developer.sailpoint.com/discuss/t/in-entra-create-provisioning-policy-for-userprincipal-name-and-mail-nickname-i-used-usename-genearor/209458/11 "2026-06-01T12:34:52Z")

</div>

Please find the provisioning policy  
{  
“name”: “Account”,  
“description”: null,  
“usageType”: “CREATE”,  
“fields”: [  
{  
“name”: “accountType”,  
“transform”: {  
“type”: “static”,  
“attributes”: {  
“value”: “User”  
}  
},  
“attributes”: {},  
“isRequired”: false,  
“type”: “string”,  
“isMultiValued”: false  
},  
{  
“name”: “userPrincipalName”,  
“transform”: {  
“type”: “rule”,  
“attributes”: {  
“name”: “Create Unique Account ID”  
}  
},  
“attributes”: {  
“template”: “ADM$firstname$lastname${uniqueCounter}@chubbfsadmin.co.uk”  
},  
“isRequired”: true,  
“type”: “string”,  
“isMultiValued”: false  
},  
{  
“name”: “password”,  
“transform”: {  
“type”: “rule”,  
“attributes”: {  
“name”: “Create Password”  
}  
},  
“attributes”: {},  
“isRequired”: true,  
“type”: “secret”,  
“isMultiValued”: false  
},  
{  
“name”: “displayName”,  
“transform”: {  
“type”: “rule”,  
“attributes”: {  
“name”: “Create Unique Account ID”  
}  
},  
“attributes”: {  
“template”: “ADM $(firstname) $(lastname)”  
},  
“isRequired”: true,  
“type”: “string”,  
“isMultiValued”: false  
},  
{  
“name”: “mailNickname”,  
“transform”: {  
“type”: “rule”,  
“attributes”: {  
“name”: “Create Unique Account ID”  
}  
},  
“attributes”: {  
“template”: “ADM$firstname$lastname${uniqueCounter}”  
},  
“isRequired”: true,  
“type”: “string”,  
“isMultiValued”: false  
},  
{  
“name”: “accountEnabled”,  
“transform”: {  
“type”: “static”,  
“attributes”: {  
“value”: “true”  
}  
},  
“attributes”: {},  
“isRequired”: false,  
“type”: “boolean”,  
“isMultiValued”: false  
},  
{  
“name”: “department”,  
“transform”: null,  
“attributes”: {},  
“isRequired”: false,  
“type”: “string”,  
“isMultiValued”: false  
},  
{  
“name”: “jobTitle”,  
“transform”: null,  
“attributes”: {},  
“isRequired”: false,  
“type”: “string”,  
“isMultiValued”: false  
},  
{  
“name”: “passwordPolicies”,  
“transform”: null,  
“attributes”: {},  
“isRequired”: false,  
“type”: “string”,  
“isMultiValued”: false  
},  
{  
“name”: “otherMails”,  
“transform”: null,  
“attributes”: {},  
“isRequired”: false,  
“type”: “string”,  
“isMultiValued”: false  
},  
{  
“name”: “givenName”,  
“transform”: {  
“type”: “identityAttribute”,  
“attributes”: {  
“name”: “firstname”  
}  
},  
“attributes”: {},  
“isRequired”: false,  
“type”: “string”,  
“isMultiValued”: false  
},  
{  
“name”: “surname”,  
“transform”: {  
“type”: “identityAttribute”,  
“attributes”: {  
“name”: “lastname”  
}  
},  
“attributes”: {},  
“isRequired”: false,  
“type”: “string”,  
“isMultiValued”: false  
},  
{  
“name”: “usageLocation”,  
“transform”: {  
“type”: “static”,  
“attributes”: {  
“value”: “GB”  
}  
},  
“attributes”: {},  
“isRequired”: false,  
“type”: “string”,  
“isMultiValued”: false  
},  
{  
“name”: “forceChangePasswordNextSignIn”,  
“transform”: {  
“type”: “static”,  
“attributes”: {  
“value”: “true”  
}  
},  
“attributes”: {},  
“isRequired”: false,  
“type”: “boolean”,  
“isMultiValued”: false  
},  
{  
“name”: “country”,  
“transform”: null,  
“attributes”: {},  
“isRequired”: false,  
“type”: “string”,  
“isMultiValued”: false  
},  
{  
“name”: “state”,  
“transform”: null,  
“attributes”: {},  
“isRequired”: false,  
“type”: “string”,  
“isMultiValued”: false  
},  
{  
“name”: “city”,  
“transform”: null,  
“attributes”: {},  
“isRequired”: false,  
“type”: “string”,  
“isMultiValued”: false  
},  
{  
“name”: “streetAddress”,  
“transform”: null,  
“attributes”: {},  
“isRequired”: false,  
“type”: “string”,  
“isMultiValued”: false  
},  
{  
“name”: “postalCode”,  
“transform”: null,  
“attributes”: {},  
“isRequired”: false,  
“type”: “string”,  
“isMultiValued”: false  
},  
{  
“name”: “physicalDeliveryOfficeName”,  
“transform”: null,  
“attributes”: {},  
“isRequired”: false,  
“type”: “string”,  
“isMultiValued”: false  
},  
{  
“name”: “telephoneNumber”,  
“transform”: null,  
“attributes”: {},  
“isRequired”: false,  
“type”: “string”,  
“isMultiValued”: false  
},  
{  
“name”: “mobile”,  
“transform”: null,  
“attributes”: {},  
“isRequired”: false,  
“type”: “string”,  
“isMultiValued”: false  
},  
{  
“name”: “facsimileTelephoneNumber”,  
“transform”: null,  
“attributes”: {},  
“isRequired”: false,  
“type”: “string”,  
“isMultiValued”: false  
},  
{  
“name”: “invitedUserEmailAddress”,  
“transform”: null,  
“attributes”: {},  
“isRequired”: false,  
“type”: “string”,  
“isMultiValued”: false  
},  
{  
“name”: “inviteRedirectUrl”,  
“transform”: null,  
“attributes”: {},  
“isRequired”: false,  
“type”: “string”,  
“isMultiValued”: false  
},  
{  
“name”: “sendInvitationMessage”,  
“transform”: null,  
“attributes”: {},  
“isRequired”: false,  
“type”: “boolean”,  
“isMultiValued”: false  
},  
{  
“name”: “customizedMessageBody”,  
“transform”: null,  
“attributes”: {},  
“isRequired”: false,  
“type”: “string”,  
“isMultiValued”: false  
},  
{  
“name”: “invitedUserDisplayName”,  
“transform”: null,  
“attributes”: {},  
“isRequired”: false,  
“type”: “string”,  
“isMultiValued”: false  
},  
{  
“name”: “invitedUserUsageLocation”,  
“transform”: null,  
“attributes”: {},  
“isRequired”: false,  
“type”: “string”,  
“isMultiValued”: false  
},  
{  
“name”: “signInNameType”,  
“transform”: null,  
“attributes”: {},  
“isRequired”: false,  
“type”: “string”,  
“isMultiValued”: false  
},  
{  
“name”: “signInNameValue”,  
“transform”: null,  
“attributes”: {},  
“isRequired”: false,  
“type”: “string”,  
“isMultiValued”: false  
},  
{  
“name”: “localAccountDisplayName”,  
“transform”: null,  
“attributes”: {},  
“isRequired”: false,  
“type”: “string”,  
“isMultiValued”: false  
},  
{  
“name”: “enableLocalAccount”,  
“transform”: null,  
“attributes”: {},  
“isRequired”: false,  
“type”: “boolean”,  
“isMultiValued”: false  
},  
{  
“name”: “b2cPassword”,  
“transform”: null,  
“attributes”: {},  
“isRequired”: false,  
“type”: “secret”,  
“isMultiValued”: false  
},  
{  
“name”: “b2cForceChangePasswordNextLogin”,  
“transform”: null,  
“attributes”: {},  
“isRequired”: false,  
“type”: “boolean”,  
“isMultiValued”: false  
},  
{  
“name”: “employeeId”,  
“transform”: {  
“type”: “identityAttribute”,  
“attributes”: {  
“name”: “identificationNumber”  
}  
},  
“attributes”: {},  
“isRequired”: false,  
“type”: “string”,  
“isMultiValued”: false  
}  
]  
}

---

<div class="post-metadata">

**Author:** ![system](https://global.discourse-cdn.com/sailpoint/original/2X/f/f2136700ed5e3703e0b85e02f6be799dacca7735.png) [@system](https://developer.sailpoint.com/discuss/u/system)\
**Post date:** [July 31, 2026, 12:35pm UTC](https://developer.sailpoint.com/discuss/t/in-entra-create-provisioning-policy-for-userprincipal-name-and-mail-nickname-i-used-usename-genearor/209458/12 "2026-07-31T12:35:30Z")

</div>

This topic was automatically closed 60 days after the last reply. New replies are no longer allowed.