When using Bob's Microsoft Active Directory Hybrid Provisioning integration, it is important to understand how Bob identifies an existing AD user and which attributes can be updated after the account has been created.
How does Bob match an employee to an AD user?
The Hybrid AD provisioning integration uses the following matching precedence:
externalId → UPN → sAMAccountName
The externalId is the strongest identifier used to maintain the relationship between the employee's Bob profile and the corresponding AD user object, provided the required mapping is configured correctly.
For the identifier mapping to work as intended, the provisioning schema should include: Bob ID → AD employeeNumber
The Bob ID is Bob's internal, system-generated identifier for the employee. It is different from the configurable Employee ID field available on an employee's profile.
Because this internal ID provides a stable identifier, the integration does not need to rely solely on attributes such as an employee's name or UPN, which may change during their employment.
Which AD attributes can be updated after user creation?
Some attributes can continue to be synchronized after the AD account has been created:
- UPN can be updated.
- Email can be updated.
Other attributes are effectively fixed after the user has been created through the integration:
- sAMAccountName
- CN (Common Name)
For example, if a user was originally created with: Bob Email → AD CN and the mapping is later changed to: Bob First name + Last name → AD CN, running another synchronization will not rename the existing AD object. The employee will retain the CN that was assigned when their AD account was originally created.
The new CN mapping will instead apply when new AD users are created through the integration.
How does Manager mapping work?
The Manager mapping depends on the employee's manager already existing in AD through the integration.
If the manager has not yet been synchronized, Bob cannot populate the employee's Manager relationship successfully. Provisioning order should therefore be considered when synchronizing employees and their managers.
Key points
- User matching follows externalId → UPN → sAMAccountName.
- Include Bob ID → AD employeeNumber in the required schema mapping.
- Bob ID is an internal system identifier and is different from the employee's configurable Employee ID.
- UPN and Email can be updated after account creation.
- sAMAccountName and CN are effectively fixed after creation.
- Changing the CN mapping does not rename existing AD users.