PIM Manager settings · Settings > Admin name prefixes & environment suffixes
Suffix by environment
| Key | NamingConventions.EnvironmentSuffixes |
|---|---|
| Where | Settings > Admin name prefixes & environment suffixes |
| Type | Map (one value per item) |
| Default | entra: -ID, ad: -AD |
| Feature | Naming that matches your organization · Community, Pro Business, Pro Enterprise, Pro MSP |
| Confirmation | PIM Manager asks you to confirm before it is switched on. |
What it does
One suffix per environment: Entra ID (cloud) and on-premises Active Directory. It fills the {Platform} / {EnvironmentSuffix} token in admin and group names, e.g. admin-abc-id for the cloud account and admin-abc-ad for its AD twin.
When set
When set: new admin names use the new suffix. The hybrid worker also uses the two suffixes to pair a cloud admin with its AD account (replace the cloud suffix with the AD suffix) for just-in-time AD group membership, and it only REMOVES AD group members whose name ends with the AD suffix. Group names whose pattern contains {Platform} use the suffix of your default environment.
When blank or default
When blank / at the default: -ID for Entra ID and -AD for Active Directory. If a suffix is missing the engine still falls back to -ID / -AD.
Risk and how to reverse it
This is not cosmetic on hybrid tenants: change the suffixes after admins exist and the hybrid worker can stop finding their AD accounts (no JIT AD membership), leave old -AD members standing in AD groups, or start treating other accounts with the new suffix as removable members. Existing account names never change. Reversible: restore the old values; the next hybrid run returns to the old pairing.
Requires
SuperAdmin in PIM Manager. Free (Community) for naming; the AD pairing applies only with on-premises Active Directory through the hybrid worker (Pro; Community has no hybrid worker). The hybrid Active Directory settings can override the cloud / AD suffix pair.
Recommended
Keep -ID / -AD. If you must change them, do it before the first admin is created, and never on a tenant whose hybrid worker already manages AD group membership.
Related settings
- Admin account domain AdminAccountUpnSuffix
- Prefix by admin type NamingConventions.AdminTypePrefixes
- Service names NamingConventions.ServiceNames
- Admin word NamingConventions.AdminWord
- Tenant common name NamingConventions.TenantCommonName
- AdminAccountPattern (admin account name) NamingConventions.AdminAccountPattern
- AdminAccountPatternHighPriv (high-privilege admin name) NamingConventions.AdminAccountPatternHighPriv
- AdminAccountDisplayNameSuffix (admin display name) NamingConventions.AdminAccountDisplayNameSuffix
- AdminAccountPatterns (how admin accounts are recognised) NamingConventions.AdminAccountPatterns
- AdminTypeDefault NamingConventions.AdminTypeDefault
- EnvironmentDefault NamingConventions.EnvironmentDefault
- ResourceGroupPattern (permission group name) NamingConventions.ResourceGroupPattern
Documented for PIM Manager 3.0.70. Written by the PIM Manager team; Invardia publishes it. · All settings · Security review pack