PIM Manager settings · Settings > Naming & accounts
Admin account domain
| Key | AdminAccountUpnSuffix |
|---|---|
| Where | Settings > Naming & accounts > Admin account domain |
| Type | Choice |
| Default | Blank (the tenant's default domain) |
| Feature | Naming that matches your organization · Community, Pro Business, Pro Enterprise, Pro MSP |
| Confirmation | PIM Manager asks you to confirm before it is switched on. |
What it does
The domain after the @ in every admin account PIM creates in this tenant, picked from the tenant's verified domains. On a managed tenant it is also the domain the admins replicated from the managing tenant are created at -- the managing tenant's domain is never carried over.
When set
When set: from the next engine run, new admin accounts whose row has no full address are created as <name>@<this domain>, and the admin wizard proposes that domain. Existing accounts keep their address -- nothing is renamed. Only a verified domain can be saved.
When blank or default
When blank: new admins are created at whatever Entra ID marks as the tenant's default domain, read at each engine run (the classic behaviour).
Risk and how to reverse it
Changing it after admins exist: an admin row stored with only a user name is then looked up at the new domain first. PIM remembers the domains used before (every change is recorded), so assignments and offboarding still find an account created at an old domain or the default domain, and offboarding remembers the account by its id once found. Reversible: pick the old value again; accounts created meanwhile keep the new domain.
Requires
SuperAdmin role to change. PIM Manager needs Domain.Read.All or Organization.Read.All to list the verified domains (without it nothing can be picked). Free (Community) and Pro.
Recommended
Leave it at the tenant default unless your admins must live on a dedicated admin domain; decide before the first admins are created.
Related settings
- Prefix by admin type NamingConventions.AdminTypePrefixes
- Suffix by environment NamingConventions.EnvironmentSuffixes
- Service names NamingConventions.ServiceNames
- Admin word NamingConventions.AdminWord
- Tenant common name NamingConventions.TenantCommonName
- AdminAccountPattern (admin account name) NamingConventions.AdminAccountPattern
- AdminAccountPatternHighPriv (high-privilege admin name) NamingConventions.AdminAccountPatternHighPriv
- AdminAccountDisplayNameSuffix (admin display name) NamingConventions.AdminAccountDisplayNameSuffix
- AdminAccountPatterns (how admin accounts are recognised) NamingConventions.AdminAccountPatterns
- AdminTypeDefault NamingConventions.AdminTypeDefault
- EnvironmentDefault NamingConventions.EnvironmentDefault
- ResourceGroupPattern (permission group name) NamingConventions.ResourceGroupPattern
Documented for PIM Manager 3.0.70. Written by the PIM Manager team; Invardia publishes it. · All settings · Security review pack