Skip to content
InvardiaInvardia
Why InvardiaProductsFeaturesPricingCommunity
Docs
All documentation
Product documentationPIM ManagerSecurityInsight
SettingsPIM Manager settingsSecurityInsight settingsEntra Policy Suite settings
ScriptsPIM Manager scriptsSecurityInsight scriptsEntra Policy Suite scriptsInvardia scripts
Error codesPIM Manager error codesSecurityInsight error codes
API and MCPPIM Manager APIPIM Manager MCP toolsSecurityInsight APISecurityInsight MCP tools
SecurityPIM Manager security packSecurityInsight security packEntra Policy Suite security pack
Network and designPIM Manager network guidesPIM Manager command wizardNetwork egressDesign your installationCalculate your cost
SupportSetup scriptsRemote support access
Search the docs
SupportAboutContactBook a demoCustomer portalDesign your installationFree Pro trial

PIM Manager settings · Settings > Admin name prefixes & environment suffixes

Prefix by admin type

KeyNamingConventions.AdminTypePrefixes
WhereSettings > Admin name prefixes & environment suffixes
TypeMap (one value per item)
Defaultinternal-adminuser: none, external-adminuser: x-, external-guest: none
FeatureNaming that matches your organization · Community, Pro Business, Pro Enterprise, Pro MSP

What it does

One prefix per admin type (internal admin, external admin / consultant, guest). The prefix fills the {AdminTypePrefix} token in the admin account patterns, so an external admin can be named x-admin-abc-id while an internal one is admin-abc-id. A prefix may itself contain tokens, e.g. adm-{TenantCommonName}-.

When set

When set: every admin account name generated from now on (Create admin wizard, CSV import, central admin script, on-premises AD names) uses the new prefix for that admin type. PIM Manager also uses the prefixes to recognise admin accounts and to check that admin rows match your convention (a warning, not a block).

When blank or default

When blank / at the default: internal admins and guests get no prefix, external admins get x-. A row that does not name an admin type uses the type set in AdminTypeDefault.

Risk and how to reverse it

Existing accounts are never renamed -- the engine works from the user name stored on each admin row. After a change, older rows can show naming warnings, and recognition of admin accounts widens to include the new prefix. Reversible: put the old value back and save; nothing in your tenant changes.

Requires

SuperAdmin in PIM Manager to change it. Free (Community). Works together with the admin account patterns (it only appears in a name where a pattern contains {AdminTypePrefix}) and AdminTypeDefault.

Recommended

Keep the shipped prefixes unless your organisation already has its own convention -- set it once, before you create the first admins, so every account follows one convention.

Related settings

  • Admin account domain AdminAccountUpnSuffix
  • Suffix by environment NamingConventions.EnvironmentSuffixes
  • Service names NamingConventions.ServiceNames
  • Admin word NamingConventions.AdminWord
  • Tenant common name NamingConventions.TenantCommonName
  • AdminAccountPattern (admin account name) NamingConventions.AdminAccountPattern
  • AdminAccountPatternHighPriv (high-privilege admin name) NamingConventions.AdminAccountPatternHighPriv
  • AdminAccountDisplayNameSuffix (admin display name) NamingConventions.AdminAccountDisplayNameSuffix
  • AdminAccountPatterns (how admin accounts are recognised) NamingConventions.AdminAccountPatterns
  • AdminTypeDefault NamingConventions.AdminTypeDefault
  • EnvironmentDefault NamingConventions.EnvironmentDefault
  • ResourceGroupPattern (permission group name) NamingConventions.ResourceGroupPattern

Documented for PIM Manager 3.0.70. Written by the PIM Manager team; Invardia publishes it. · All settings · Security review pack

InvardiaInvardia

See the risk. Control the access.

Products

PIM ManagerSecurityInsightEntra Policy SuiteAll featuresPricingFree 60-day Pro trialBook a demoWhy Invardia

Docs

DocumentationSearch the docsPIM Manager settingsSecurityInsight settingsPIM network guidesCommand wizardNetwork egressPIM Manager design configuratorSecurityInsight design configuratorDesign your installationCalculate your cost

Company

AboutContactCustomer portalSupportHow support worksHow updates reach youSupport in numbersSetup scriptsRemote support accessContact: info@invardia.com

Legal

Terms of saleLicence termsData processingPrivacyCookiesCompany information
© 2026 Invardia – a brand of 2LINKIT, founded and owned by Morten Knudsen · Strandvejen 21A, 6000 Kolding, Denmark · VAT DK39208032 · Contact: info@invardia.com