PIM Manager settings · Settings > AD OU placement
AD OU (Day2Day Admins)
| Key | NamingConventions.PathAdmins |
|---|---|
| Where | Settings > AD OU placement (admin accounts) |
| Type | Text |
| Default | Blank (no AD admin accounts are created) |
| Feature | PIM for on-premises Active Directory · Pro Business, Pro Enterprise, Pro MSP |
| Confirmation | PIM Manager asks you to confirm before it is switched on. |
What it does
The on-premises Active Directory OU (distinguished name, e.g. OU=Admins,DC=example,DC=com) where new day-to-day admin accounts are created. Only for tenants with on-premises AD.
When set
When set: on its next scheduled run the hybrid worker creates every due on-premises admin row (Environment / platform AD) that is not high-privilege as an AD user in this OU, with an initial password delivered to the admin mail recipient.
When blank or default
When blank: AD admin accounts are not created -- each one is skipped with the reason target OU empty. Cloud-only tenants leave it blank; nothing else depends on it.
Risk and how to reverse it
Setting it lets PIM Manager create accounts in your AD for the first time. Changing it only affects new accounts; existing accounts are never moved. Reversible: clear it and creation stops on the next run; accounts already created stay in AD.
Requires
Pro (hybrid Active Directory) and a hybrid worker whose identity may create users in this OU. SuperAdmin in PIM Manager. The high-privilege OU is set separately.
Recommended
Use a dedicated admin OU that is protected and excluded from sync to Entra ID; leave it blank if you have no on-premises AD.
Related settings
- On-premises Active Directory (hybrid worker) FeatureGates.hybrid.ad
- AD OU (High Priv Admins) NamingConventions.PathAdminsL0T0
- AD group marker HybridAdGroupMarker
- Pattern override HybridAdGroupPattern
- Cloud admin suffix HybridAdCloudSuffix
- AD admin suffix HybridAdAccountSuffix
- OU for new AD groups HybridAdGroupsOu
- Per-server group format HybridAdServerGroupFormat
- Shared server-admins group HybridAdServerAdminsGroup
- Never remove HybridAdProtectedMembers
- Groups per batch HybridAdSyncBatchSize
- Batches at once HybridAdSyncParallel
- Read activation end times as UTC HybridAdEndTimeAsUtc
- Server discovery: only these OUs HybridAdServerSearchOus
- Server discovery: OUs to leave out HybridAdServerExcludeOus
- Server discovery: last changed within (days) HybridAdServerActiveDays
- Server discovery: only names like HybridAdServerNameInclude
- Server discovery: never names like HybridAdServerNameExclude
- New servers in these OUs are offered for approval as one list HybridAdServerAutoGroupOus
- Server groups created per run HybridAdServerAutoGroupMaxPerRun
- Clean-up: also look for old PIM groups in these OUs HybridAdCleanupOus
Documented for PIM Manager 3.0.70. Written by the PIM Manager team; Invardia publishes it. · All settings · Security review pack