Unique samaccountname/upn generation - is it possible to decrement letters from a name, if not unique.

Question

Unique samaccountname/upn generation - is it possible to decrement letters from a name, if not unique.

VedaPraneetha Edala 5

I'd like to generate samaccountname following below logic.

First name: John
Last name: West
samaccountname generation logic: <lastname><firstletteroffirstname>westj, westjo,westjoh,westjohn
if still not unique should start decreasing the letters of last name
wesj, wesjo,wesjoh, westjohn

or
wesjohn, wejohn

Does Entra expression mapping support decrement of letters?

Another Q: Selectuniqievalue() - understood that this will make sure to generate unique values as output. If name of the person has only 3 letters e.g, Tim West. But my samaccount expression logic checks until 5 letters of firstname. In this case what will be my output be - keeps checking until uniqueness is achieved /error / keeps repeating same values after 3?

0 comments

2 answers

Your answer

Answer 1

Deleted

This answer has been deleted due to a violation of our Code of Conduct. The answer was manually reported or identified through automated detection before action was taken. Please refer to our Code of Conduct for more information.

Comments have been turned off. Learn more

Answer 2

For samAccountName/UPN generation, expressions support generating multiple candidate values and then picking the first unique one, but they do not support dynamically “shrinking” and “growing” both first and last name segments in the exact pattern described.

Supported pattern for uniqueness

The supported way to implement uniqueness is to:

Build a sequence of candidate values using functions such as Join, Mid, Replace, NormalizeDiacritics, etc.
Wrap those candidates in SelectUniqueValue(...).
The provisioning service checks each candidate in order against the target directory and returns the first value that is not already in use.

Examples in the documentation show patterns like:

First initial + last name, then add numeric suffixes for duplicates.
Increase the number of characters from the first name when duplicates are found (e.g., canderson → chanderson → chranderson).
For Workday/SuccessFactors, similar logic is used to generate unique sAMAccountName values while respecting length and character rules.

This mechanism can be adapted to many patterns (e.g., more characters from first name, adding numbers, or alternative combinations), but the expression language does not provide a built‑in way to automatically “start decreasing the letters of lastname” after exhausting all first‑name expansions. That behavior would have to be encoded explicitly as separate candidate rules if needed.

Behavior of SelectUniqueValue when out of candidates

SelectUniqueValue works as follows:

It evaluates each argument (each is a complete expression that produces one candidate value).
For each candidate, it checks the target directory/app for uniqueness.
The first candidate that is unique is returned.
If all candidate values already exist, the entry is escrowed and the reason is logged in the audit logs.

Important points from the documentation:

SelectUniqueValue must be at the top level and cannot be nested.
It is only for entry creation and only for specific provisioning scenarios (Workday→AD, SuccessFactors→AD, API‑driven provisioning to on‑premises AD).
It cannot be used on attributes with matching precedence.

Regarding the “out of letters” scenario (e.g., a 3‑letter name but logic that conceptually “checks up to 5 letters”):

The function does not “keep repeating the same old values.”
It does not automatically generate more candidates than are explicitly provided.
If the expressions for each argument all evaluate to values that are already present in the target directory, SelectUniqueValue will not return a value; instead, the provisioning entry is escrowed and the failure reason is logged.

So if the expression is written such that only a finite set of candidates can be produced (e.g., all based on a 3‑letter name) and all of those are taken, SelectUniqueValue stops after those candidates and the object is escrowed; it does not loop or repeat.

For patterns that must handle short names, additional candidate rules (for example, adding numeric suffixes or other transformations) should be added explicitly to the SelectUniqueValue argument list.

References: