Entra Policy Suite settings · Settings > Identity report
AD validation: service account OU pattern
| Key | IdentityReport.AdOu.ServiceAccount |
|---|---|
| Where | Settings > Identity report |
| Type | Text |
| Default | (empty) |
| Feature | The identity report as gap views · Community |
What it does
Which AD location is right for an AD-synced service account. A regular expression matched against the user's on-premises distinguished name (e.g. OU=Users,OU=Corp). Empty: nobody is validated by this rule.
When set
Used from the next report run.
When blank or default
Empty: every AD-synced service account is listed as in the wrong OU.
Risk and how to reverse it
Report only. Reversible.
Requires
Admin.
Recommended
The OU your service accounts live in.
Related settings
- Identity report IdentityReport.Enabled
- Snapshots to keep IdentityReport.KeepRuns
- Mail the workbook after each run IdentityReport.MailWorkbook
- Who gets the workbook IdentityReport.MailRecipients
- Device counts: devices synced in the last N days IdentityReport.DeviceCountWindowDays
- Inactive after N days IdentityReport.InactiveDays
- Long inactive after N days IdentityReport.LongInactiveDays
- Guests inactive after N days IdentityReport.GuestInactiveDays
- New hires: grace period (days) IdentityReport.NewHireGraceDays
- Hire date attribute IdentityReport.HireDateAttribute
- AD validation: user OU pattern IdentityReport.AdOu.User
- AD validation: shared user OU pattern IdentityReport.AdOu.SharedUser
- AD validation: shared mailbox OU pattern IdentityReport.AdOu.SharedMailbox
- Leave these users out of the report IdentityReport.ExcludeObjects
Documented for Entra Policy Suite 2.0.107. Written by the Entra Policy Suite team; Invardia publishes it. · All settings · Security review pack