PIM Manager settings · Settings > Hybrid AD & workloads
Cloud admin suffix
| Key | HybridAdCloudSuffix |
|---|---|
| Where | Settings > Hybrid AD & workloads > Hybrid Active Directory (PIM for AD) |
| Type | Text |
| Default | Blank (the Entra suffix of your naming conventions, -ID as shipped) |
| Feature | PIM for on-premises Active Directory · Pro Business, Pro Enterprise, Pro MSP |
| Confirmation | PIM Manager asks you to confirm before it is switched on. |
What it does
The end of a cloud admin account name (its mail nickname) that the hybrid worker swaps for the AD admin suffix to find the matching on-premises account. Example: Admin-JDOE-ID in Entra ID becomes Admin-JDOE-AD in AD. Only a trailing suffix is swapped; a name without it maps to the same name in AD.
When set
When set: activated members are mapped to AD accounts with this suffix swapped out. A changed value changes which AD account is added to a group when someone activates the PIM group, from the next sync pass.
When blank or default
When blank / at the default: the Entra suffix from your naming conventions is used (-ID as shipped). If your conventions name no suffix, accounts map to the same name in AD.
Risk and how to reverse it
A wrong suffix maps people to AD accounts that do not exist (the add fails and the sync reports failures) or to the wrong account. Accounts added under the old mapping no longer count as wanted and are removed if they carry the AD admin suffix. Reversible: set the right value; the next pass corrects the membership.
Requires
Pro (On-premises Active Directory feature) and a running hybrid worker. SuperAdmin to change. Works together with HybridAdAccountSuffix.
Recommended
Leave blank so it follows your naming conventions; set it only when your cloud admin names use a different ending than the conventions say.
Related settings
- On-premises Active Directory (hybrid worker) FeatureGates.hybrid.ad
- AD OU (Day2Day Admins) NamingConventions.PathAdmins
- AD OU (High Priv Admins) NamingConventions.PathAdminsL0T0
- AD group marker HybridAdGroupMarker
- Pattern override HybridAdGroupPattern
- AD admin suffix HybridAdAccountSuffix
- OU for new AD groups HybridAdGroupsOu
- Per-server group format HybridAdServerGroupFormat
- Shared server-admins group HybridAdServerAdminsGroup
- Never remove HybridAdProtectedMembers
- Groups per batch HybridAdSyncBatchSize
- Batches at once HybridAdSyncParallel
- Read activation end times as UTC HybridAdEndTimeAsUtc
- Server discovery: only these OUs HybridAdServerSearchOus
- Server discovery: OUs to leave out HybridAdServerExcludeOus
- Server discovery: last changed within (days) HybridAdServerActiveDays
- Server discovery: only names like HybridAdServerNameInclude
- Server discovery: never names like HybridAdServerNameExclude
- New servers in these OUs are offered for approval as one list HybridAdServerAutoGroupOus
- Server groups created per run HybridAdServerAutoGroupMaxPerRun
- Clean-up: also look for old PIM groups in these OUs HybridAdCleanupOus
Documented for PIM Manager 3.0.70. Written by the PIM Manager team; Invardia publishes it. · All settings · Security review pack