AD sync templates | Identum Knowledge Base

This article describes how AD sync templates for users work in eADM, what each tab and field controls, and how to configure export and import mappings. It covers the two standard templates shipped with eADM: AD: Active users and AD: Deactivated users.

What is a sync template?

A sync template is the configuration object that controls what eADM writes to Active Directory — and reads back from it — during a synchronisation cycle. It defines:

Which synchronisation step executes the template (e.g. Export AD)
Which ruleset determines which users are in scope
Where in the AD OU structure user objects are placed (Object path)
Which AD attributes are written and with which values (Export mappings)
Which AD attributes are read back into eADM (Import mappings)

Templates are found under Automation → Synchronisation in the left navigation. Each template is listed by name below the Synchronisation heading.

Template tabs

Each sync template has five tabs: Information, Object path, Visma, Export, and Import.

Information

The Information tab shows the template's core settings.

Field	Description
Id	Internal numeric identifier for the template.
Name	Display name, e.g. AD: Active users or AD: Deactivated users.
Active	Whether the template is active. Inactive templates are not executed during sync cycles.
Object type	The eADM object type this template operates on. Both standard AD templates use User.
Description	Optional free-text description.
Synchronisation step	The sync step that runs this template, typically Export AD.
Ruleset	The ruleset that determines which users are processed by this template. The active-users template uses a ruleset that matches enabled employees; the deactivated-users template uses a ruleset that matches terminated or disabled employees.
Permanent deletion	If enabled, eADM deletes the AD object when the user leaves scope. The deactivated-users template typically has this set to Yes, with an await deletion period (e.g. 90 days) before the object is permanently removed.
Delete home directory	If enabled, eADM deletes the user's home directory on permanent deletion.
Send full update for object upon changes	If enabled, all export mappings are re-written whenever any change is detected on the user, rather than only changed attributes.

Object path

The Object path tab defines the OU mapping — where in Active Directory eADM creates or moves user objects. Each entry is labelled Object path #N and shows an Absolute path built from OU and DC components.

Examples from the standard templates:

Template	Example absolute path
AD: Active users	`OU=Brukere,OU=Brukerkontoer,DC=eksempel,DC=kommune,DC=no`
AD: Deactivated users	`OU=Disabled users,OU=Brukerkontoer,DC=eksempel,DC=kommune,DC=no`

When a user moves from active to deactivated scope, eADM moves the AD object from the active OU to the disabled OU automatically.

Note: The OU path must match the actual OU structure in the organisation's Active Directory. Incorrect paths will cause export failures. Verify the path with the organisation's AD administrator before configuring.

Export

The Export tab lists all Export mappings — the attribute writes that eADM performs on the AD user object during each sync cycle. Each row maps one source expression to one AD target attribute.

Export mapping columns

Column	Description
Id	Internal mapping identifier.
Source	The value or expression written to the target. May be a static value (e.g. `512`, `TRUE`, `NO`), a field placeholder (e.g. `[UserName]`), or a composed expression using the rule expression engine (e.g. `[givenname] [surname]`).
Target	The AD attribute name that receives the value (e.g. `samAccountName`, `userPrincipalName`, `displayName`).
Empty target	If Yes, eADM writes the value even when the source expression evaluates to empty — effectively clearing the attribute in AD.
Foreign key	Used for relational lookups, e.g. resolving the manager attribute via `User.Manager`.
Ruleset	If set, this mapping is only executed when the user matches the specified ruleset, e.g. `HRM-brukere`.

Standard export mappings — AD: Active users

Source	Target	Notes
`[UserName]`	`samAccountName`
`[surname]`	`sn`
`[givenname] [surname]`	`displayName`
`[userpassword]`	`userPwd`
`512`	`userAccountControl`	512 = normal enabled account
`[Company]`	`company`
`[givenname] [surname]`	`cn`
`[Mobile]`	`mobile`	Empty target: Yes
`[title]`	`title`
`NO`	`c`	Country code, static value
`[Socialsecuritynumber]`	`employeeID`
`[EmployeeNumber]`	`employeeNumber`	Ruleset: HRM-brukere
`UserId`	`manager`	Foreign key: User.Manager
`[WorkPhone]`	`telephoneNumber`	Empty target: Yes
`[givenname]`	`givenName`
`[Department] - [Title]`	`description`
`[Email]`	`mail`
`[WebUserId]`	`extensionAttribute14`
`[UserName]@eksempelkommune.no`	`userPrincipalName`	Domain suffix is organisation-specific
`[Department]`	`department`
`[DepartmentNumber]`	`departmentNumber`

Standard export mappings — AD: Deactivated users

Source	Target	Notes
`TRUE`	`msExchHideFromAddressLists`	Hides the account from the Exchange/M365 address book
`Deaktivert av eAdm [SUBSTRING;0;10;[Deleted]]`	`description`	Writes a timestamped deactivation note to the AD description attribute
`514`	`userAccountControl`	514 = disabled account

Import

The Import tab lists Import mappings — attributes read back from AD into eADM after the export step. This is used to keep eADM in sync with values that AD may update independently.

The standard active-users template imports one attribute:

Source (AD attribute)	Target (eADM field)	Notes
`lastLogonTimestamp`	`ExtensionAttribute12`	Start delta sync: No

Configuring the UPN and email naming standard

The userPrincipalName and mail mappings control how eADM constructs login names and email addresses. The source expression is evaluated against each user's HR data at sync time.

The recommended production expression uses [SPLIT] to extract only the first given name, [CLEAN] and [LOWER] to normalise the result, two [REPLACE] calls to sanitise separator characters, and [UNIQUE] to prevent address collisions:

[UNIQUE;[LOWER;[REPLACE;[REPLACE;[LOWER;[CLEAN;[SPLIT;[GivenName]; ;0]]].[LOWER;[CLEAN;[Surname]]];-;.];...;.]]@eksempelkommune.no;Upn;@eksempelkommune.no]

The expression evaluates as follows:

Step	Function	Purpose
1	`[SPLIT;[GivenName]; ;0]`	Extracts the first word of the given name field, discarding any additional given names.
2	`[CLEAN;...]`	Removes characters that are unsafe in usernames. Note: `[CLEAN]` retains hyphens.
3	`[LOWER;...]`	Converts each name part to lowercase before concatenation.
4	`firstgivenname.surname`	Dot separator between the two name parts is added as a literal in the expression.
5	`[REPLACE;...;-;.]`	Replaces any remaining hyphens (e.g. from hyphenated surnames) with dots.
6	`[REPLACE;...;...;.]`	Collapses any sequence of three dots (produced when a name part is empty or short) into a single dot.
7	`[UNIQUE;...;Upn;@eksempelkommune.no]`	Checks the generated value against the `Upn` attribute across all users. If already taken, appends an incrementing number. The third parameter specifies the email domain so that `[UNIQUE]` performs the collision check on the full address.

Example: GivenName = Anne Karin, Surname = Eksempel → anne.eksempel@eksempelkommune.no

Example with hyphenated surname: GivenName = Per, Surname = Ås-Eksempel → per.as.eksempel@eksempelkommune.no

Note: Replace @eksempelkommune.no with the organisation's actual domain in both the address literal and the [UNIQUE] domain parameter. Both occurrences must match.

Testing expressions with the Expression Builder

Use Sysadmin tools → Expression Builder to preview any source expression before applying it to a sync template.

Select User as the primary object type.
Choose a test user via Search or Choose randomly.
Enter the expression in the editor and click Execute.
Review the result and repeat with users representing edge cases: hyphenated names, single-word given names, names with special characters, and users where a collision is expected.

Editing a sync template

Navigate to Automation → Synchronisation and select the template from the left menu.
Click Edit (bottom right) to enter edit mode, or use the pencil icon (top right) to edit inline.
To add or change an export mapping, go to the Export tab in edit mode and update the source expression for the relevant row.
Save the template and run a manual synchronisation on a test group to verify output before enabling for all users.

Last updated: June 26, 2026