How to Provision Users to Active Directory

Create the AD Organizational Unit

Create a dedicated OU in Active Directory where Identity Mesh will provision new user accounts.

# PowerShell — run on a domain controller or machine with RSAT
New-ADOrganizationalUnit -Name "IMObjects" `
  -Path "DC=identitymesh,DC=com" `
  -Description "Provisioned by Identity Mesh"

Create the HR Database Table

If you don't already have an HR database, create a sample Employees table and insert test data.

CREATE TABLE Employees (
    EmployeeId    INT PRIMARY KEY,
    FirstName     NVARCHAR(100),
    LastName      NVARCHAR(100),
    Email         NVARCHAR(200),
    Department    NVARCHAR(100),
    Title         NVARCHAR(100),
    EmployeeType  NVARCHAR(50),
    ModifiedDate  DATETIME2 DEFAULT GETUTCDATE()
);

Insert a sample employee:

INSERT INTO Employees
    (EmployeeId, FirstName, LastName, Email, Department, Title, EmployeeType)
VALUES
    (1001, 'Jane', 'Doe', 'jane.doe@identitymesh.com',
     'Engineering', 'Software Engineer', 'Employee');

Configure the SQL Database Connector

In the Admin UI, navigate to Connectors → Add Connector and select SQL Database.

The resulting ConfigJson will look like:

{
  "ConnectionString": "Server=sqlserver;Database=HumanResources;Integrated Security=true;",
  "ImportQuery": "SELECT * FROM Employees",
  "ExternalIdColumn": "EmployeeId",
  "DeltaColumn": "ModifiedDate"
}

Configure the Active Directory Connector

Add a second connector for Active Directory. Navigate to Connectors → Add Connector and select Active Directory.

The resulting ConfigJson will look like:

{
  "LdapServer": "dc01.identitymesh.com",
  "BaseDn": "DC=identitymesh,DC=com",
  "SearchBases": ["OU=IMObjects,DC=identitymesh,DC=com"],
  "UseSsl": true,
  "LdapPort": 636,
  "Filter": "(&(objectClass=user)(objectCategory=person))",
  "ExternalIdAttribute": "objectGUID",
  "CreateEnabled": true,
  "EnableAfterCreate": true,
  "AttributesToLoad": [
    "sAMAccountName", "displayName", "givenName", "sn",
    "mail", "department", "title", "employeeID"
  ]
}

Create the Join Rule

A join rule tells Identity Mesh how to correlate imported objects with mesh objects. Navigate to Rules → Join Rules → Add Join Rule.

When an employee is imported from SQL, the engine reads EmployeeId directly from the raw connector object and searches mesh object attributes for a matching employeeId. Join rules work independently of inbound flow rules — no flow rule is needed for the join to match. If no match is found, a new mesh object is created with this as its anchor value.

Create Inbound Flow Rules

Flow rules define how attributes move from the SQL management space into the mesh. Navigate to Rules → Flow Rules → Add Flow Rule and create one rule per attribute.

The confidence score of 90 means the HR system is a high-authority source. If another connector provides the same attribute with a lower confidence, the HR value wins.

Create the Projection Rule

A projection rule tells Identity Mesh which mesh objects should be provisioned to a target connector. Navigate to Rules → Projection Rules → Add Projection Rule.

The precondition script filters out contractors — only full employees will be provisioned to AD. Remove this condition if you want all employee types to be provisioned.

Create Projection Attribute Rules

Projection attribute rules define how mesh attributes map to the target AD attributes. Add one rule per attribute on the projection rule you just created.

Run the Initial Import

Trigger a full import from the SQL connector to pull employee records into the management space and apply join/flow rules.

Verify Mesh Objects

Navigate to Mesh Objects in the Admin UI and confirm the imported data was joined and flowed correctly.

Run the Export

The projection engine has evaluated the projection rule and queued Jane Doe for creation in AD. Trigger an export on the AD connector.

Verify the User in Active Directory

Confirm the new user account was created in the target OU with the correct attributes.

# PowerShell
Get-ADUser -Filter "sAMAccountName -eq 'JDoe'" `
  -SearchBase "OU=IMObjects,DC=identitymesh,DC=com" `
  -Properties displayName, givenName, sn, mail, department, title, Enabled, PasswordLastSet

Expected output:

Test Delta Sync

Verify that changes in the HR database flow through to Active Directory automatically.

1. Update the HR record:

UPDATE Employees
SET Title = 'Senior Software Engineer',
    ModifiedDate = GETUTCDATE()
WHERE EmployeeId = 1001;

2. Run a delta import on the Corporate HR connector via the Admin UI.

3. Verify the mesh object's title attribute updated to "Senior Software Engineer".

4. Run an export on the Corporate AD connector.

5. Verify in AD:

# PowerShell
(Get-ADUser -Filter "sAMAccountName -eq 'JDoe'" -Properties title).title
# Expected output: Senior Software Engineer