For Entra ID cloud connectors, use the Username Generator transform in the create profile instead of identity attribute rules. The transform supports uniqueCounter for generating unique usernames like firstname.lastname## and is designed for provisioning operations, avoiding the thread-safety issues of rules during aggregation (discussion).
Unlike AD’s before-operation rules, cloud connectors rely on transforms configured directly in the source’s create profile attributes for account creation operations.