Configuring Custom UPN Suffixes for Active Directory Account Creation - Identity Manager

Products

• CA Directory
• CA Identity Manager
• CA Identity Governance
• CA Identity Portal

Issue/Introduction

By default, Active Directory (AD) accounts are created with a User Principal Name (UPN) reflecting the full domain (e.g., [email protected]). If you require a different UPN suffix format (e.g., [email protected]), you can override the default value by modifying the Active Directory Account Template in Identity Manager.

Environment

Identity Manager 14.5

Cause

Active Directory automatically appends the domain name to the UPN during account creation. To force a specific format, you must explicitly define the suffix within the Identity Manager Account Template, which overrides the default AD behavior.

Resolution

You can configure the UPN suffix using either the Identity Manager User Console or the Provisioning Manager.

Using the Identity Manager User Console or Provisioning Manager:

1. Open the Active Directory Account Template.
2. Navigate to the Account tab.
3. Locate the User Logon Name field.
4. Update the field to include your desired suffix using the %AC% placeholder (e.g., [e-mail]).
   • Note: This entry explicitly overwrites the default UPN suffix generated by Active Directory.
5. Click Apply to save the changes.
6. Trigger a new account creation task to verify that the UPN is generated with the custom suffix.

Additional Information

The above instructions can be achieved from both the Identity Manager User Console or by using the Provisioning Manager.

To speak with a customer representative or a Support Engineer see Contact Support. Scroll to the bottom of the page and click on your respective region.