ServiceNow- Microsoft Active Directory INTEGRATION: Unable to change userPrincipalName (UPN)

[Sohini Kar]

Description:

We are using the Microsoft Active Directory v2 Spoke (IntegrationHub) to provision new AD user accounts via a ServiceNow Flow. We have identified two separate gaps in the spoke's available actions and need guidance or a fix for both.

Issue 1: userPrincipalName (UPN) not settable

• The "Create User" and "Update User" actions in this spoke do not expose any field for setting userPrincipalName (UPN).
• Our organization's AD forest uses two different values: the AD domain is ABCcorp.com, but user accounts need their UPN set explicitly to <username>@ABCcom (a registered alternate UPN suffix). Corp needs to be removed.
• Accounts created via this spoke default to UPN <username>@ABCcorp.com, which is incorrect for our use case.
• We reviewed the full list of actions available in this spoke (via Action Type Bases) and found no action (e.g., "Update Object," "Set Attribute") that can write this attribute either during or after account creation.

Issue 2: PasswordNeverExpires not available

• Our organization's requirement is for newly created AD accounts to have the "Password never expires" account option enabled at creation.
• We searched the "Additional Fields" dropdown on both "Create User" and "Update User" actions (which lists other AD attributes such as City, Company, Country, Department, Description, Home Directory, Mobile Phone, Office Location, Sam Account Name, State, Street Address, Title) but could not find any field corresponding to "Password Never Expires" or the underlying AD attribute (userAccountControl / PasswordNeverExpires).
• This means we currently have no way to set this option through the spoke.

What we need for both issues:

• Confirmation on whether the AD_v2 Spoke supports setting these attributes through any existing action we may have missed, or
• Guidance on the supported way to extend/customize this spoke to add this capability (e.g., via a custom PowerShell-based action, similar to how Create User/Update User execute PowerShell under the hood)

[SaurabhT7455244]

Hi Sohini,

Yes — both are valid gaps in the current Microsoft Active Directory v2 Spoke.

For Create User, ServiceNow currently derives the UPN as:

<username>@<DNS-domain-name>

So with AD DNS domain ABCcorp.com, OOB creation gives user@ABCcorp.com. There is no exposed input to override it with the alternate suffix @ABCcom.

PasswordNeverExpires is also not exposed by the OOB Create/Update User actions. Microsoft AD itself supports both attributes through PowerShell, so the limitation is the ServiceNow spoke action, not AD.

Recommended implementation

Do not modify the Store spoke/OOB action directly. Keep the OOB Create User action, then immediately call a custom IntegrationHub action.

Create:

Custom Action: Set AD User Properties

Inputs:

sam_account_name    String
user_principal_name String
password_never_expires Boolean

Add a PowerShell step using the same AD v2 Connection/Credential Alias and MID Server. ServiceNow supports PowerShell steps with input variables passed from the action.

PowerShell:

Import-Module ActiveDirectory

Set-ADUser `
    -Identity $sam_account_name `
    -UserPrincipalName $user_principal_name `
    -PasswordNeverExpires $password_never_expires `
    -ErrorAction Stop

Map the PowerShell step input variables:

sam_account_name
    = Action Input → sam_account_name

user_principal_name
    = Action Input → user_principal_name

password_never_expires
    = Action Input → password_never_expires

Then your flow becomes:

1. Microsoft AD v2 → Create User

2. Custom → Set AD User Properties
      sam_account_name    = testing
      user_principal_name = testing@ABCcom
      password_never_expires = true

Set-ADUser natively supports both -UserPrincipalName and -PasswordNeverExpires. PasswordNeverExpires sets the underlying ADS_UF_DONT_EXPIRE_PASSWD flag in userAccountControl.

One important constraint: if your Create User logic sets Change password at next logon = true, you cannot simultaneously set PasswordNeverExpires = true. Microsoft explicitly treats those options as incompatible.

So I would implement it as a small post-create custom action rather than cloning the whole AD v2 Create User action. It is cleaner and avoids maintaining a fork of the ServiceNow Store spoke.

Thanks,

Saurabh