> For the complete documentation index, see [llms.txt](https://docs.openiam.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.openiam.com/getting-started-guide/lifecycle/provision-test-account.md).

# Provision a test account to AD

Create a user in OpenIAM and watch it provision out to Active Directory.

**Goal:** create one identity in OpenIAM and watch it appear in AD — the first deliberate write of the POC.\
**Time:** 30–45 minutes.\
**Prerequisites:** imports verified ([Import users and group memberships](/getting-started-guide/lifecycle/import-users-and-memberships.md)); `ON_DELETE = DISABLE` confirmed ([Connect OpenIAM to Active Directory](/getting-started-guide/lifecycle/connect-to-ad.md), step 2 — verify it again now, before the first write).

## How provisioning is triggered (so the steps make sense)

OpenIAM provisions to a target when an **active user gains an entitlement linked to that target** — typically a role or group associated with the managed system. The engine then builds the account from the managed system's **policy map** (the attribute recipe: which AD attributes to write, from which OpenIAM fields) and sends the operation to the connector. Deprovisioning is the mirror image: delete the user (or let their last qualifying entitlement end) and the engine sends the delete — which your `ON_DELETE = DISABLE` converts into a disable.

{% stepper %}
{% step %}
**Review the policy map**

On the managed system, open the policy map. The shipped AD PowerShell map writes, among others: `SamAccountName` (the principal), `Name` (CN), `GivenName`, `Surname`, `DisplayName`, `UserPrincipalName`, `Enabled`, `AccountPassword`, and `Groups`. Also available but inactive by default: `Department`, `Title`, `Path` (target OU), and others — leave the defaults for the POC. Note that new accounts are created under the managed system's **Base DN for User** (`OU=Provisioned,…` from [Connect OpenIAM to Active Directory](/getting-started-guide/lifecycle/connect-to-ad.md)).
{% endstep %}

{% step %}
**Create the provisioning role**

Create the role that will carry the AD entitlement:

1. **Access Control → Roles → Create** — name it `POC AD Access`, save.
2. Open the new role's **Entitlements** tab and add the AD managed system's **resource** (every managed system has a resource of the same name — search for it there).
3. Save. The role now means "has an account on AD": assigning it to an active user is the provisioning trigger; removing it (or deleting the user) is the deprovisioning side you'll exercise on the next page.

(The imported users from [Import users and group memberships](/getting-started-guide/lifecycle/import-users-and-memberships.md) already carry the shipped "End User" role — using a separate, deliberate role keeps the test account's cause-and-effect obvious.)
{% endstep %}

{% step %}
**Create the test identity**

In User Admin, create a new user — someone who does **not** exist in AD — with first/last name, an email, and the login **`poc.provision1`**. The login is the user's principal, which the policy map writes to AD as `SamAccountName` — so what you type here is the account name that will appear in AD. Assign the `POC AD Access` role. Activate the user.
{% endstep %}

{% step %}
**Watch it happen**

* OpenIAM side: the user's managed-system identities should show an AD identity; the audit/log viewer shows the ADD operation.
* Connector side (Windows): the connector log shows the ADD request and result.
* AD side:

{% code overflow="wrap" %}

```powershell
Get-ADUser poc.provision1 -Properties Enabled,DistinguishedName,MemberOf
```

{% endcode %}

The account should exist under `OU=Provisioned,OU=OpenIAM-POC,…`, enabled, with the attributes from the policy map.

**About the account's password:** the initial AD password is generated by the policy map's `AccountPassword` rule (a Groovy script — the shipped sample uses a predictable initial-password pattern). That's fine for watching an account get created; review and replace the script's logic before any real rollout, and don't distribute POC-account credentials.
{% endstep %}
{% endstepper %}

## If it failed

| Symptom                          | Likely cause                                                                                                                                                       |
| -------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
| Nothing reaches the connector    | The role isn't linked to the managed system, or the user isn't active                                                                                              |
| Connector returns FAIL on create | Target DN outside `PermittedDN` — check Base DN for User vs PermittedDN ([Connect OpenIAM to Active Directory](/getting-started-guide/lifecycle/connect-to-ad.md)) |
| Created but missing attributes   | Attribute inactive in the policy map, or source field empty on the user                                                                                            |
| Password errors                  | `AccountPassword` policy conflicts with the AD domain password policy                                                                                              |

## You know this worked when…

{% hint style="success" %}
`Get-ADUser poc.provision1` returns the account in the right OU with the mapped attributes, and both the OpenIAM audit log and connector log show the ADD. Screenshot all three.
{% endhint %}

Next: [Deprovision by disabling](/getting-started-guide/lifecycle/deprovision-disable.md).


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://docs.openiam.com/getting-started-guide/lifecycle/provision-test-account.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.