Entra Policy Suite settings · Settings > Identity report
AD validation: user OU pattern
| Key | IdentityReport.AdOu.User |
|---|---|
| Where | Settings > Identity report |
| Type | Text |
| Default | (empty) |
| Feature | The identity report as gap views · Community |
What it does
Which AD location is right for an AD-synced user (views 'AD users in the right / wrong OU' and the shared device user views). A regular expression matched against the user's on-premises distinguished name (e.g. OU=Users,OU=Corp). Empty: nobody is validated by this rule.
When set
Used from the next report run.
When blank or default
Empty: every AD-synced user is listed as in the wrong OU.
Risk and how to reverse it
Report only. A wrong pattern only moves users between the two views. Reversible.
Requires
Admin.
Recommended
The OU your user accounts are created in.
Related settings
- Identity report IdentityReport.Enabled
- Snapshots to keep IdentityReport.KeepRuns
- Mail the workbook after each run IdentityReport.MailWorkbook
- Who gets the workbook IdentityReport.MailRecipients
- Device counts: devices synced in the last N days IdentityReport.DeviceCountWindowDays
- Inactive after N days IdentityReport.InactiveDays
- Long inactive after N days IdentityReport.LongInactiveDays
- Guests inactive after N days IdentityReport.GuestInactiveDays
- New hires: grace period (days) IdentityReport.NewHireGraceDays
- Hire date attribute IdentityReport.HireDateAttribute
- AD validation: service account OU pattern IdentityReport.AdOu.ServiceAccount
- AD validation: shared user OU pattern IdentityReport.AdOu.SharedUser
- AD validation: shared mailbox OU pattern IdentityReport.AdOu.SharedMailbox
- Leave these users out of the report IdentityReport.ExcludeObjects
Documented for Entra Policy Suite 2.0.107. Written by the Entra Policy Suite team; Invardia publishes it. · All settings · Security review pack