PIM Manager settings · Settings > Hybrid AD & workloads
AD group marker
| Key | HybridAdGroupMarker |
|---|---|
| Where | Settings > Hybrid AD & workloads > Hybrid Active Directory (PIM for AD) |
| Type | Text |
| Default | -S_AD |
| Feature | PIM for on-premises Active Directory · Pro Business, Pro Enterprise, Pro MSP |
| Confirmation | PIM Manager asks you to confirm before it is switched on. |
What it does
The text at the end of a PIM group name that marks the group as also existing in your on-premises Active Directory. The hybrid worker mirrors every defined PIM group named <your group prefix>*<marker> to an AD security group of the same name, and keeps that AD group's members in step with who has the PIM group activated. The marker is also the {marker} part of the per-server group name.
When set
When set: only defined PIM groups ending in this marker are mirrored and synced. Groups that newly match are created in AD (if an OU for new AD groups is set) and their members synced: users carrying the AD admin suffix without an active PIM activation are removed. The hybrid worker's change check picks up a saved value on its next pass and re-runs the group mirror at once.
When blank or default
When blank / at the default: the marker -S_AD is used, so groups named like <prefix>*-S_AD are mirrored (the shape the older PIM-for-AD scripts used).
Risk and how to reverse it
Changing the marker changes which AD groups the worker manages. Groups that stop matching are no longer synced: their current AD members are left as they are and no longer removed when an activation ends. Groups that start matching get non-activated PIM-managed users removed. Nothing is deleted from AD. Reversible: set the old marker back; the next pass syncs the old groups again.
Requires
Pro (On-premises Active Directory feature) and a running hybrid worker. SuperAdmin to change. The worker needs Graph Group.Read.All, User.Read.All and PrivilegedAssignmentSchedule.Read.AzureADGroup, and AD rights on the groups. Ignored when Pattern override is set.
Recommended
Keep -S_AD unless your groups already use another marker. Change it only together with renaming your PIM groups.
Related settings
- On-premises Active Directory (hybrid worker) FeatureGates.hybrid.ad
- AD OU (Day2Day Admins) NamingConventions.PathAdmins
- AD OU (High Priv Admins) NamingConventions.PathAdminsL0T0
- Pattern override HybridAdGroupPattern
- Cloud admin suffix HybridAdCloudSuffix
- AD admin suffix HybridAdAccountSuffix
- OU for new AD groups HybridAdGroupsOu
- Per-server group format HybridAdServerGroupFormat
- Shared server-admins group HybridAdServerAdminsGroup
- Never remove HybridAdProtectedMembers
- Groups per batch HybridAdSyncBatchSize
- Batches at once HybridAdSyncParallel
- Read activation end times as UTC HybridAdEndTimeAsUtc
- Server discovery: only these OUs HybridAdServerSearchOus
- Server discovery: OUs to leave out HybridAdServerExcludeOus
- Server discovery: last changed within (days) HybridAdServerActiveDays
- Server discovery: only names like HybridAdServerNameInclude
- Server discovery: never names like HybridAdServerNameExclude
- New servers in these OUs are offered for approval as one list HybridAdServerAutoGroupOus
- Server groups created per run HybridAdServerAutoGroupMaxPerRun
- Clean-up: also look for old PIM groups in these OUs HybridAdCleanupOus
Documented for PIM Manager 3.0.70. Written by the PIM Manager team; Invardia publishes it. · All settings · Security review pack