Insufficient Access Error When Updating AD User via After Create Rule in IdentityNow

SailPoint Human Fabric (SHF) SHF Discussion and Questions
, ,
1

Hi everyone,

I’ve set up an Active Directory (AD) connector in SailPoint IdentityNow and configured account provisioning successfully. New user accounts are being created in AD without any issues via the connector.

I recently added an After Create connector rule to generate a unique employeeID for each new user. The employeeID generation logic runs on the IQService server using a PowerShell script, and it correctly generates the expected value.

However, when the script attempts to update the employeeID attribute via PowerShell (using standard AD cmdlets like Set-ADUser), the operation fails with the following error:

image
image1679×182 19.1 KB

“Insufficient Access Rights to Perform the Operation”

What I’ve verified so far:

  • The same service account is used for both the AD connector and IQService.

  • That service account has all required write permissions on the target OU and the employeeID attribute.

  • I manually logged into the IQService server using the service account, opened PowerShell ISE, and confirmed that I can manually run the same script to update the employeeID successfully.

  • The error only occurs during execution via the connector rule, not during manual testing.

    Any insights or suggestions are greatly appreciated.

    Thanks in advance!

2

Any reason why you cant generate the same value in ISC ?

3

Due to big logic behind generation so unable to do it from create account generator

4

I mean you can still write a rule ?

5

If any changes will required then it will be difficult to modify cloud rule, but in connector rule it is easy