PIM Manager settings · Settings > Hybrid AD & workloads
AD admin suffix
| Key | HybridAdAccountSuffix |
|---|---|
| Where | Settings > Hybrid AD & workloads > Hybrid Active Directory (PIM for AD) |
| Type | Text |
| Default | Blank (the AD suffix of your naming conventions, -AD as shipped) |
| Feature | PIM for on-premises Active Directory · Pro Business, Pro Enterprise, Pro MSP |
| Confirmation | PIM Manager asks you to confirm before it is switched on. |
What it does
The end of the AD admin account a cloud admin maps to, and the safety marker for removals: the sync only ever removes a USER from a mirrored AD group when its account name ends in this suffix. Service accounts, nested groups and users without the suffix are always kept and reported as not PIM-managed.
When set
When set: activated members are added as <name><suffix> in AD, and every user in a mirrored group that carries this suffix but has no active PIM activation is removed on the next sync pass (the sync runs continuously on the hybrid worker).
When blank or default
When blank / at the default: the AD suffix from your naming conventions is used (-AD as shipped). If neither names a suffix, the sync adds members but removes nobody.
Risk and how to reverse it
Setting a suffix that other accounts in those AD groups also carry makes those accounts removable: they are taken out of the mirrored groups unless they have an active PIM activation or are listed under Never remove. Reversible for future passes, but removed memberships are only re-added when the person activates again.
Requires
Pro (On-premises Active Directory feature) and a running hybrid worker. SuperAdmin to change. Works together with HybridAdCloudSuffix and HybridAdProtectedMembers.
Recommended
Leave blank to follow your naming conventions. Use a suffix only your PIM-created AD admin accounts carry.
Related settings
- On-premises Active Directory (hybrid worker) FeatureGates.hybrid.ad
- AD OU (Day2Day Admins) NamingConventions.PathAdmins
- AD OU (High Priv Admins) NamingConventions.PathAdminsL0T0
- AD group marker HybridAdGroupMarker
- Pattern override HybridAdGroupPattern
- Cloud admin suffix HybridAdCloudSuffix
- OU for new AD groups HybridAdGroupsOu
- Per-server group format HybridAdServerGroupFormat
- Shared server-admins group HybridAdServerAdminsGroup
- Never remove HybridAdProtectedMembers
- Groups per batch HybridAdSyncBatchSize
- Batches at once HybridAdSyncParallel
- Read activation end times as UTC HybridAdEndTimeAsUtc
- Server discovery: only these OUs HybridAdServerSearchOus
- Server discovery: OUs to leave out HybridAdServerExcludeOus
- Server discovery: last changed within (days) HybridAdServerActiveDays
- Server discovery: only names like HybridAdServerNameInclude
- Server discovery: never names like HybridAdServerNameExclude
- New servers in these OUs are offered for approval as one list HybridAdServerAutoGroupOus
- Server groups created per run HybridAdServerAutoGroupMaxPerRun
- Clean-up: also look for old PIM groups in these OUs HybridAdCleanupOus
Documented for PIM Manager 3.0.70. Written by the PIM Manager team; Invardia publishes it. · All settings · Security review pack