# Restrict the AD sync for one source in case of having two HR source **URL:** \ **Category:** SHF Discussion and Questions\ **Tags:** provisioning, sailpoint-identity-security\ **Created:** [January 9, 2024, 1:28pm UTC](https://developer.sailpoint.com/discuss/t/restrict-the-ad-sync-for-one-source-in-case-of-having-two-hr-source/23870 "2024-01-09T13:28:49Z")\ **Posts on this page:** 8\ **Page:** 1
**Author:** ![kanha141](https://avatars.discourse-cdn.com/v4/letter/k/71e660/32.png) [@kanha141](https://developer.sailpoint.com/discuss/u/kanha141)\ **Post date:** [January 9, 2024, 1:28pm UTC](https://developer.sailpoint.com/discuss/t/restrict-the-ad-sync-for-one-source-in-case-of-having-two-hr-source/23870/1 "2024-01-09T13:28:49Z")
Is there any way to restrict the AD sync for one source in case of having two HR source? ---
**Author:** ![dopstrick](https://sea1.discourse-cdn.com/sailpoint/discuss/user_avatar/developer.sailpoint.com/dopstrick/32/5232_2.png) [@dopstrick](https://developer.sailpoint.com/discuss/u/dopstrick)\ **Post date:** [February 12, 2024, 3:00pm UTC](https://developer.sailpoint.com/discuss/t/restrict-the-ad-sync-for-one-source-in-case-of-having-two-hr-source/23870/2 "2024-02-12T15:00:31Z")
The AD attribute sync is going to be sourced from an Identity attribute, which will be determined by transform or rule on the Identity profile. How is the identity attribute (value to be synced to AD) getting its value? ---
**Author:** ![RAKGDS](https://sea1.discourse-cdn.com/sailpoint/discuss/user_avatar/developer.sailpoint.com/rakgds/32/2795_2.png) [@RAKGDS](https://developer.sailpoint.com/discuss/u/RAKGDS)\ **Post date:** [February 13, 2024, 4:54am UTC](https://developer.sailpoint.com/discuss/t/restrict-the-ad-sync-for-one-source-in-case-of-having-two-hr-source/23870/3 "2024-02-13T04:54:19Z")
Hi Arjun, You can do it using a Tranform. What you can do is based on the transform calculate what value you need to send to AD from which HR source. Once that is calculate you can send only that value to AD ---
**Author:** ![kanha141](https://avatars.discourse-cdn.com/v4/letter/k/71e660/32.png) [@kanha141](https://developer.sailpoint.com/discuss/u/kanha141)\ **Post date:** [February 15, 2024, 11:28am UTC](https://developer.sailpoint.com/discuss/t/restrict-the-ad-sync-for-one-source-in-case-of-having-two-hr-source/23870/4 "2024-02-15T11:28:31Z")
@dopstrick @RAKGDS Thanks for your inputs. We have two HR sources, one is authoritative (A) and some of the managers are not in (A) so we are maintaining them in another Non Employee source (B). We don’t want to sync the user data from source B into the AD specially the manager field which is having null value in SailPoint. ---
**Author:** ![dopstrick](https://sea1.discourse-cdn.com/sailpoint/discuss/user_avatar/developer.sailpoint.com/dopstrick/32/5232_2.png) [@dopstrick](https://developer.sailpoint.com/discuss/u/dopstrick)\ **Post date:** [February 15, 2024, 1:30pm UTC](https://developer.sailpoint.com/discuss/t/restrict-the-ad-sync-for-one-source-in-case-of-having-two-hr-source/23870/5 "2024-02-15T13:30:57Z")
If I’m understanding the use case correclty, I think the easiest way would be to create an ‘adManager’ attribute on the Identity, which just sources from source A. Use that attribute for sync to AD. ---
**Author:** ![RAKGDS](https://sea1.discourse-cdn.com/sailpoint/discuss/user_avatar/developer.sailpoint.com/rakgds/32/2795_2.png) [@RAKGDS](https://developer.sailpoint.com/discuss/u/RAKGDS)\ **Post date:** [February 18, 2024, 10:00am UTC](https://developer.sailpoint.com/discuss/t/restrict-the-ad-sync-for-one-source-in-case-of-having-two-hr-source/23870/6 "2024-02-18T10:00:16Z")
Did u try using transform to calculate the value and send it to the target ? Could you please let us know what issue are you facing if you use transform to populate the value and sync it to target? ---
**Author:** ![KevinHarrington](https://sea1.discourse-cdn.com/sailpoint/discuss/user_avatar/developer.sailpoint.com/kevinharrington/32/6776_2.png) [@KevinHarrington](https://developer.sailpoint.com/discuss/u/KevinHarrington)\ **Post date:** [February 18, 2024, 2:00pm UTC](https://developer.sailpoint.com/discuss/t/restrict-the-ad-sync-for-one-source-in-case-of-having-two-hr-source/23870/7 "2024-02-18T14:00:35Z")
The following transform looks up the user’s record from Source A. If it does not exist it returns the static string “IN SOURCE B”. It then uses a lookup and returns the current “manager” value from AD if the input is “IN SOURCE B” otherwise it returns the manager’s distinguished Name as calculated by your logic - I just put in a stand-in “Calculate Manager AD distinguishedName” reference as an example. ```auto { "attributes":{ "input":{ "attributes":{ "ignoreErrors":"true", "values":[ { "attributes":{ "attributeName":"uniqueIdentifierFromSourceA", "sourceName":"Source A" }, "type":"accountAttribute" }, "IN SOURCE B" ] }, "type":"firstValid" }, "table": { "IN SOURCE B":{ "attributes":{ "ignoreErrors":"true", "values":[ { "attributes":{ "attributeName":"manager", "sourceName":"Active Directory" }, "type":"accountAttribute" }, "" ] }, "type":"firstValid" }, "default":{ "attributes":{ "id":"Calculate Manager AD distinguishedName" }, "type":"reference" } } }, "type":"lookup" } ``` ---
**Author:** ![system](https://global.discourse-cdn.com/sailpoint/original/2X/f/f2136700ed5e3703e0b85e02f6be799dacca7735.png) [@system](https://developer.sailpoint.com/discuss/u/system)\ **Post date:** [April 18, 2024, 2:00pm UTC](https://developer.sailpoint.com/discuss/t/restrict-the-ad-sync-for-one-source-in-case-of-having-two-hr-source/23870/8 "2024-04-18T14:00:41Z")
Closed on April 18, 2024, 2:00pm UTC This topic was automatically closed 60 days after the last reply. New replies are no longer allowed.