PIM Manager settings · Settings > Hybrid AD & workloads
Never remove
| Key | HybridAdProtectedMembers |
|---|---|
| Where | Settings > Hybrid AD & workloads > Hybrid Active Directory (PIM for AD) |
| Type | List |
| Default | Blank (no extra protected accounts) |
| Feature | PIM for on-premises Active Directory · Pro Business, Pro Enterprise, Pro MSP |
| Confirmation | PIM Manager asks you to confirm before it is switched on or off. |
What it does
Account names (comma or semicolon separated, no wildcards) that the just-in-time sync never removes from a mirrored AD group, even when they carry the AD admin suffix and have no active PIM activation. They are reported as kept (protected).
When set
When set: the listed accounts keep their membership in every mirrored AD group permanently, from the next sync pass. People with an active activation are still added as usual.
When blank or default
When blank / at the default: every user carrying the AD admin suffix without an active PIM activation is removed from the mirrored groups. Users without that suffix, service accounts and nested groups are kept anyway.
Risk and how to reverse it
A listed account keeps standing privileged membership in AD, outside just-in-time control. Clearing the list makes those accounts removable at once: the next pass takes them out of every mirrored group where they have no active activation. Reversible: edit the list; removed memberships come back only through a new activation or by hand.
Requires
Pro (On-premises Active Directory feature) and a running hybrid worker. SuperAdmin to change. Only matters for accounts that carry the AD admin suffix.
Recommended
Keep it empty or to a short list of break-glass or emergency AD accounts you have documented.
Related settings
- On-premises Active Directory (hybrid worker) FeatureGates.hybrid.ad
- AD OU (Day2Day Admins) NamingConventions.PathAdmins
- AD OU (High Priv Admins) NamingConventions.PathAdminsL0T0
- AD group marker HybridAdGroupMarker
- Pattern override HybridAdGroupPattern
- Cloud admin suffix HybridAdCloudSuffix
- AD admin suffix HybridAdAccountSuffix
- OU for new AD groups HybridAdGroupsOu
- Per-server group format HybridAdServerGroupFormat
- Shared server-admins group HybridAdServerAdminsGroup
- Groups per batch HybridAdSyncBatchSize
- Batches at once HybridAdSyncParallel
- Read activation end times as UTC HybridAdEndTimeAsUtc
- Server discovery: only these OUs HybridAdServerSearchOus
- Server discovery: OUs to leave out HybridAdServerExcludeOus
- Server discovery: last changed within (days) HybridAdServerActiveDays
- Server discovery: only names like HybridAdServerNameInclude
- Server discovery: never names like HybridAdServerNameExclude
- New servers in these OUs are offered for approval as one list HybridAdServerAutoGroupOus
- Server groups created per run HybridAdServerAutoGroupMaxPerRun
- Clean-up: also look for old PIM groups in these OUs HybridAdCleanupOus
Documented for PIM Manager 3.0.70. Written by the PIM Manager team; Invardia publishes it. · All settings · Security review pack