Adaxes Q&A - Recent questions

Group type in e-mail function?

Tue, 16 Jun 2026 12:41:40 +0000

I'm setting up e-mail notifications when a group is created or deleted through Adaxes. One thing I'd like to include is what type of group is being created (Distribution, M365, Security), and unfortunately the adm-AzureGroupType doesn't quite work as it only returns a number. I'm sure these correspond to the known types but you cannot translate that in an email. Is there a better variable I can use? Or do I need to go the Powershell route instead of just using email?

Add AES in account options?

Thu, 11 Jun 2026 08:41:52 +0000

Is it possible to have those account options added to Adaxes to support AES in the case of the RC4 depreciation in business rules? Like After Creation, ... modify account options... or define them by default in the Properties?

Entra ID Extension Property

Wed, 10 Jun 2026 10:46:26 +0000

Is it possible to view Entra Extesions Properties via Adaxes. For example in this article it shows how to add a new property to specify what groups shoudl write back to on-prem AD. I want to be able to see groups that have this set in the Entra View

https://learn.microsoft.com/en-us/entra/identity/hybrid/cloud-sync/tutorial-directory-extension-group-provisioning

Adjust default value expressions

Fri, 05 Jun 2026 14:34:52 +0000

I am looking for a way to adjust how properties are expressed, without creating a custom attribute.

For example, the attribute "Lockout-Time" is shown as "enspecified" if they aren't locked out.

However I'd like it to say "User is not locked." I've created custom attributes for things like this, but I was wondering if I could change it without creating a custom attribute.

Thank you!

Staged Upgrade Approach & Version Compatibility Query - Adaxes 2025.1

Mon, 01 Jun 2026 10:04:04 +0000

Hi team,

We are running version 2025.1 - 3.17.23904.0 with three servers and one SQL server. Two of the three servers are used for web access behind a load balancer.

We would like to install the new version on only one server and test it before updating the others.

Could we do the following?

Install the new version on Server 2
Shut down/stop the service on Servers 1 and 3
Test and check Adaxes on Server 2
Then either update Servers 1 and 3, or reinstall the old version on Server 2 if needed

Do you recommend any other approach? Are there any compatibility issues if we revert to the previous version (internal database/settings and SQL logging database)?

Unable to modify Exchange settings for resource accounts migrated to Exchange Online

Fri, 29 May 2026 09:55:45 +0000

No edit button is available within Adaxes for these accounts. The service account has 'Mail Recipients' and 'MailRecipientCreation' permissions assigned. What additional configuration or permissions might be needed?

Are Adaxes custom attribute usable in rule based groups

Thu, 28 May 2026 14:48:56 +0000

I have a custom adaxes attribute that I would like to utlitize in Rule Based groups; it does not look like they are available to select, however.

Example: want something like IF customattribute IS value - then add to group.

Is this possible to make them visable in the Rule Based queries somehow?

script development and SDLC ...

Thu, 28 May 2026 08:45:56 +0000

I am introducing Adaxes to more of my IT team ... and this includes those who are in DevOps and want to put everything in a Git repo.

I'm not an expert on this (SDLC / CICD pipelines ... so my terminology may not be 100% spot on ...

With that said, Is there any support in Adaxes for integration with a SDLC / software deployment system?

I've been a user of Adaxes for years but I've always managed my scripts manually - keeping copies locally in my file system.

Thanks.

Adaxes source of Property Patterns for Country

Wed, 27 May 2026 11:00:10 +0000

Hi,

from where gets Adaxes the list of values prefilled, especially for the Country attribute?

I noticed there is a value of "CS" which is not supported on Active Directory.

Thanks.

Are Exchange Online-only MailContacts expected to be visible in the Adaxes directory picker?

Wed, 27 May 2026 10:52:47 +0000

We are using Adaxes Directory Object Picker for selecting Distribution Group members.

We create external recipients as Exchange Online MailContacts (via New-MailContact).

These contacts:

are visible in Exchange / Outlook GAL
are NOT visible in Adaxes directory picker (even with Contact/InetOrgPerson filters)

Questions:

Are Exchange Online-only MailContacts expected to be visible in the Adaxes directory picker?
If not, is there a supported way to include these objects in selection (e.g. via custom query or other object type)?
Is this limitation related to Adaxes only querying directory objects (AD / Entra), not Exchange recipient objects?

Context: We are using cloud-only contacts (no on-prem AD sync).

Can Adaxes be used without Active Directory?

Fri, 22 May 2026 08:39:04 +0000

We are getting rid of our internal Active Directory. So far the process has gone very well. All of our 250 users have been transitioned to Entra and all of our applicaitons are configured for SSO with Entra. WE LOVE ADAXES (and have recommended it to so many people)! It does such a great job with user management and because we sync our AD accounts to Entra, it also does an excellent job of managing our Entra environment. But what happens when AD is gone. I know that Adaxes can manage cloud accounts, but it still seems to have that reliance on AD. AD is dying a slow death. It's a security nightmare that needs to be eliminated. Keeping an AD environment around to only support Adaxes just doesn't make sense. We have been reluctantly shopping around for a replacement to Adaxes, but nothing compares. Please tells us we can run Adaxes without AD or at the very least you have a cloud only release of Adaxes on the horizon.

Bulk Update of Rule-Based Groups Following AD Restructure

Tue, 19 May 2026 09:08:09 +0000

Hi team,

Due to some restructuring in our native AD, we need to update our rule-based groups - specifically the scope of the rules, which need to be changed from something like OU=old,DC=domain,DC=tld to DC=domain,DC=tld, or to include a new OU in the rule, such as OU=new,DC=domain,DC=tld.

Do you have anything in place for bulk updating these, or a script to manage this? I already looked at the SDKs but could not find the best approach.

Thanks

SDK Documentation - Export Function or AI Accessibility Improvement

Tue, 19 May 2026 08:44:55 +0000

Hi team,

I was trying to check and improve my scripts with AI assistance and attempted to read the relevant SDK pages directly.

However, this does not work properly and I need to export the pages first as MD files to be able to work with them.

Is there an export function available, or is there an improvement planned to better support fetching information?

Thanks.

Update Adaxes from 2023.2 to 2026.1

Wed, 13 May 2026 13:39:42 +0000

We're going to be upgrading and Im wondering if there's any caveats we should be aware of in such a major version jump. We have 2 backend servers and 2 frontend servers.

When someone is using a Custom Command, can you detect (PowerShell) who initiated the CC?

Tue, 12 May 2026 08:18:48 +0000

When someone is using a Custom Command, can you detect (WIth PowerShell as Action) "who initiated" the Custom Command?

I found that you can use e.g.: adm-InitiatorFullName to have the full name of the Initiator, is this correct?

Where can we find more info about the object: $Context.Initiator and the properties of this object that are available or are only the %Adm-InitiatorFullname%; ...EMail; ...Dn available?

When creating a scheduled task, you select Object type. e.g.: User => can you add extra (LDAP) filters

Mon, 11 May 2026 12:00:07 +0000

When creating a scheduled task, you select Object type. e.g.: User but can you add an additional filter, eg. where deparment is a value (HR, IT, ...) or where an extensionAttribute15 equals 'Mailbox'?

We have an external process (SFProvisioning) and HR or other people can request a mailbox for a person. We like to do this with a custom commend that set a value in AD e.g.: ExtAttrib15 and then run a scheduled task on all objects that have this value set to a specific value.

In a custom command you have when starting the 'pop-up' are you sure and at the end the summary witht the execution log.

Can you customize these pop-ups and/or can you during the progress of the CC add an extra pop-up when e.g more information from the requestor is needed?

Adaxes URL locations

Mon, 04 May 2026 08:36:03 +0000

I found a URL that's being used and I am not sure where it's coming from. I've looked everywhere to see how it's even accessible.

The url directs people to a reset password page that's diffferent thn the ones I manage in the web config page. It is not associated with any of the Web Interfaces when I go to edit them.

The URL ends with /adaxes/#/SelfPasswordReset

Image below of the page that looks different than the ones created with web config. This is also not the same as the "Forgot password?" prompt at the bottom of the other Web Interfaces:

The only spot I've seen it is in OS Integration, but that isn't enabled right now. You can see it's grayed out, and the URL is a bit differen't, the hastag is instead the name of one of the Web Interfaces (I blacked it out in the image below)

Is it planned to support this AD integrated feature with a future version?

Tue, 28 Apr 2026 08:27:53 +0000

Adding support for -MemberTimeToLive would be benefitial.

How can I email a newly created user's group membership?

Mon, 27 Apr 2026 08:43:21 +0000

Would it be best to use the standard Powershell to pull the user's group membership and can that be embedded in a notification email after a user is created? Or is there a variable that will do this that I seem to be missing.

Entra Guest users & sponser attribute within Adaxes

Fri, 24 Apr 2026 10:58:31 +0000

Hello, Thank you for the clarification. I understand that, as of today, Adaxes does not provide built‑in functionality to create Microsoft Entra (Azure AD) guest users and that this can only be achieved via scripts using Microsoft Graph. I would like to ask a follow‑up question to this topic:

Is native support for creating Entra guest (B2B) users currently on the Adaxes product roadmap, or under consideration for a future release? If such functionality is planned, is it also intended to support the Microsoft Entra Sponsors attribute (the sponsors relationship on guest users used for governance, access reviews, and entitlement management)?

The ability to manage guest users natively in Adaxes, including assigning or maintaining the Entra sponsor relationship, would greatly improve governance and lifecycle management in Entra‑only or hybrid environments. Thank you in advance for any insight you can share regarding roadmap status or long‑term direction. Kind regards,

Willem

In Adaxes how can I backup a user's group membership before I run through a deprovisioning?

Thu, 23 Apr 2026 14:08:51 +0000

I find it's a good idea to have backups of a user's group membership when they depart so I'd like to be able to do this.

Microsoft 365 account activation and license assignment may fail when done in one action

Thu, 23 Apr 2026 08:46:49 +0000

This issue may occur when activating a Microsoft 365 account for a user and assigning licenses in the same action.

Symptoms

The following error is returned:

License assignment cannot be done for user with invalid usage location.

Cause

This may be caused by recent changes on the Microsoft side that may have introduced internal propagation delays for the usageLocation property.

Solution

We are currently investigating the exact cause and working on a permanent fix.

As a workaround, split the action into two separate actions. One to activate the account and another to assign licenses. Then, insert a Run a program or PowerShell script action that adds a 1-minute delay between them.

Can the Exchange Management Tools only be safely installed on an Adaxes Server?

Wed, 22 Apr 2026 13:56:54 +0000

Microsoft supports decommissioning your last on prem Exchange Server and managing receipients using Windows PowerShell. See: https://learn.microsoft.com/en-us/exchange/manage-hybrid-exchange-recipients-with-management-tools

Unfortunately, this means that we can no longer run commands remotely to the Exchange Server. We can run commands against any domain attached machine if it has the Exchange Management Tools only on it.

Can the Exchange Management Tools be installed safely on an Adaxes Server?

Where can I find the e-mail body from a approval Email Notifications

Wed, 22 Apr 2026 10:10:10 +0000

we have a Request approval for user creation

I need to change the body from the Email Notification. Between Header and Footer. Where can we change it?

Entra domain top-level nodes show as N/A after restoring from a backup

Tue, 21 Apr 2026 14:39:53 +0000

This issue can be encountered when restoring configuration from backups created in Adaxes 2025.1 Update 5 (build 3.17.24628) or earlier.

Symptoms

After restoring the configuration, actions that use an Entra domain as a top-level node are no longer visible in the web interface.

Cause

In the affected versions, the top-level node settings of web interface actions referenced Entra domains by their GUID instead of Object ID (a persistent identifier).

As a result, when Entra domains are restored from the backup file with newly generated GUIDs, the web interface is no longer able to locate them.

Solution

After restoring a configuration backup made on an affected version, verify that no web interface actions have N/A as the top-level node. If any do, replace it with the appropriate Entra domain.

Is there any possibility to grant a scheduled task to view ALL pending approval requests?

Thu, 16 Apr 2026 15:47:36 +0000

I want to query all pending approval Request to check if there's already an pending request for a specific object. I can create a security Role with the needed rights, but cannot assign it to the scheduled task. is there any otther possibility to check?

Does the Backup and Restore backup EVERYTHING?

Wed, 15 Apr 2026 15:09:34 +0000

Since we are required to uninstall Adaxes in order to upgrade it to a newer version, what will be lost in the process?

Does uninstalling it remove everything, or does it leave behind any configuration files?

Does the Backup and Restore Utility back up everything in Adaxes, so that when I restore it on the new installation, everything will be the same as before?

o365 remove licenses not inherited

Mon, 13 Apr 2026 16:52:27 +0000

Is there a script to remove all O365 licenses except the ones that are inherited? Currently the automation is working, it's removing the licenses (except the ones that are inherited) but it comes back with an "error" "user license is inherited and cannot be removed". If that is not possible, is it possible to remove the error from the task report? tx

Any alert when an account is added to an admin group?

Mon, 13 Apr 2026 11:00:16 +0000

Is there a report that will notify me or an auditor when a user has been added to the Domain Admin group or any other 365 Admin Role?

RC4 is being deprecated

Mon, 06 Apr 2026 14:27:45 +0000

https://techcommunity.microsoft.com/blog/coreinfrastructureandsecurityblog/what-changed-in-rc4-with-the-january-2026-windows-update-and-why-it-is-important/4504732

Have you guys created any kind of rules or mechanisms to check if accounts in adaxes are going to be affected by this RC4 deprecation?

Ghost (email) actions Adaxes

Thu, 02 Apr 2026 13:42:00 +0000

We use Adaxes for our user LifeCyclemanagement Flows.

This flows scheduled actions are running in user context. Recently, users have been receiving emails from severals flows containing incorrect data, even though the account does not meet the conditions to receive these emails. Additionally, other actions in the flow were not executed, and no logging of these actions is visible in Adaxes. The data in the daily overview reports is correct.

How to specify which objects get licensed

Thu, 02 Apr 2026 08:01:36 +0000

We have a certain amount of licenses. We recently integrated with EntraID and all the objects got auto-licensed. We only want user accounts (no mailboxes/no guests accounts etc) to consume a license. I can do this manually but it will get very tidious any time a guest account or new object is created in Entra. Is there any way to specify a rule for this?

Adaxes/Azure client secret expired, now giving me errors

Mon, 30 Mar 2026 13:44:33 +0000

I am attempting to reset the client secret for the Application Registration for Adaxes. I have copied the client secret value from the new secret and using the same App Registration as before with all the permissions originally set. After several minutes of it claiming the client secret is wrong, now it complains:

It couldn't be any more wrong

Move-AdmObject Cannot find object: A referral was returned from server

Fri, 27 Mar 2026 10:01:19 +0000

I am running the following PowerShell script that moves an object from one OU to another in our Entra tenant.

Note this is an Entra id guest account that exists. It finds the account using Get-AdmObject by UPN. The distinguished name reference is correct as the target OU.

Is the path syntax different because its a container vs an OU? I have tried using the distinguished name, adsPath and objectGuid of the target location object with the same results.

But when I try to move the object to the new OU, it returns the following error:

$upn = "email_domain.com#EXT#@domain.onmicrosoft.com"

<# Only used to get the domain object #>
$domainDN = "%distinguishedName%"
$domain = $Context.GetObjectDomain($domainDN)

$Context.LogMessage("$domain", "Information")

<# works getting user by upn on domain #>
try {
    $user = Get-AdmObject -Filter {userPrincipalName -eq $upn} -Server $domain -AdaxesService localhost                
}
catch [System.Exception] {
    $Context.LogException("Error: Get-AdmUser threw exception when trying to find guest user by UPN")        
}

 <# adaxes account found with matching upn #>
if (-not $user) {
    $Context.LogException("No user found in Adaxes by UPN $upn")
}

$Context.LogMessage("$($user.objectGUID)", "Information")

Move-AdmObject -Identity $user -TargetPath "%distinguishedName%"

How would I enforce users only being added to a group I've created from a custom command / script?

Thu, 26 Mar 2026 14:22:58 +0000

Hello,

We are currently rolling out a deployment for Windows Hello. For this, we have created a custom automation in Adaxes for users to have to reset their passwords on next login to something complex, then that new password is not required to be reset after the fact. They are then added to a group which is assigned to this password policy. Is there a good way to make sure users can only be added into this group via our script (we want to avoid people being added on accident), and for only our admins to be able to edit or see this group? Or, do you have another recommendation for getting this done?

Thank you.

Should I be able to import remote Exchange powershell into a script? It's seemingly just freezing / timing out.

Thu, 26 Mar 2026 13:16:11 +0000

This is from within a custom task. Account has proper RBAC permissions and I can do this from a normal powershell window.

Do you have a script for creating Azure Entra only accounts in bulk from CSV?

Thu, 26 Mar 2026 13:00:05 +0000

The csv I am using contains firstname,lastname,fullname,pass I will use fullname for both fullname and log on name and pass for the password.

Share Mailbox during onboarding without an active directory

Wed, 18 Mar 2026 10:08:36 +0000

I have a user that is looking to have a user calendar be shared on onboarding with all other users with reviewer permissions. We are exploring options to accomplish this task and are wondering if this is a good solution.

How can I add users to (and remove users from) a group based on the M365 License a user has?

Wed, 11 Mar 2026 10:11:16 +0000

We would like the membership in a distribution group to be based on a particular M365 license a user has (for example, Microsoft Copilot for Microsoft 365 (SKU part number _Microsoft_365Copilot).

If a user has the license, they are in the group. If the user does not have the license, they should not be in the group.

Is there way to do that by making it a rule-based group?

Property Pattern Regex Validation Help

Wed, 11 Mar 2026 10:08:25 +0000

First off, thank you for not shoving AI into Adaxes and for continuing to improve it.

I'm trying to set property pattern validation for new user creation and I'm a little stuck. Specifically, I want to make sure that the data entered:

doesn't start with a space
doesn't end with a space
doesn't contain a 'smart' quote (‘ ’ “ ”)
doesn't contain multiple sequential spaces (so no double/triple/etc spaces)

I did see I could impose the "must not start/end with" but that doesn't solve #3 and #4

Regex looks good but maybe I'm not quoting it properly? This does work for #1 and #2 but doesn't work for #3 unless there's two 'smart' quotes next to each other ^[^\s][^\‘\’\“\”]+[^\s]$

I had tried this which didn't work for #3 either because it seems to see it as this string "‘’“”", regex101.com reckons it needs to be escaped like above. ^[^\s][^‘’“”]+[^\s]$

I haven't been able to figure out #4 multiple spaces cause adding \s{2,} doesn't work.

I could use Powershell validation but I'd prefer to have it on the form itself as then when the user is entering the data it tells them why it's an issue.

Am I just testing against the wrong flavor of regex? It does look like \‘\’\“\” would be incorrect for .NET because it doesn't need the backslashes but I tested with that and had the same issue of needing at least two 'smart' quotes to trigger the error message.

Any assistance is much appreciated

SOLVED: without numbers ^[A-Z](?:[a-zA-Z\'\-])*(?: [a-zA-Z\'\-]+)*$

with numbers ^[A-Z](?:[a-zA-Z0-9\'\-])*(?: [a-zA-Z0-9\'\-]+)*$

See bottom for more details or run it through regex101.com

Display Name in web form

Fri, 06 Mar 2026 11:54:31 +0000

Hello!

So I'm attempting to create a form that my help desk team uses to change a user account from contractor (usernames end with -c) to a FTE employee (no -c). I have a script to handle this but is there anyway in the webform that when a a help desk tech selects a user for conversion it displays the potential new name and email before actually running the business rules?

Does Adaxes provide a calculated last‑logon value for AD and Entra, or must I combine properties myself?

Wed, 04 Mar 2026 12:23:42 +0000

I am building lifecycle automation in Adaxes and need to determine both user inactivity and whether a user has ever logged in. The adm-InactivityDuration property already calculates combined activity across AD and Microsoft Entra ID, but this value includes non-logon events such as password changes or the account creation date. For lifecycle decisions I need a logon‑only value, combining:

AD lastLogon AD lastLogonTimestamp Entra sign‑in activity (lastSignInDateTime and lastNonInteractiveSignInDateTime)

My questions are:

Does Adaxes provide a built‑in calculated property (similar to adm-InactivityDuration) that returns the most recent logon event across both AD and Entra? If no such property exists, which Adaxes properties should I use to manually construct this combined “Last Logon” logic? Can such a property be created using a Calculated Property in Adaxes, and if so, which fields are recommended?

I want to ensure I use the correct properties for:

determining whether a user ever logged in, and determining the true most recent login across AD and Entra.

Thank you in advance for the clarification.

Portal Actions Referencing Moved or Invalid OUs

Wed, 04 Mar 2026 10:35:37 +0000

Hi,

we have a custom action in our Adaxes portal that allows users to select only users from a specific country and only if they are members of two specific groups.

Due to a recent restructuring, these groups were moved to new OUs. We noticed afterward that the action criteria was not updated and is still pointing to the old OU.

Is there a way to automate this or make the criteria dynamically update when such changes occur?

Or do we need to manually review and update our actions each time objects are moved or restructured?

Additionally, is it possible to receive a notification or run a script that checks for invalid or non‑existing objects referenced in action criteria?

Our action and criteria are as follows:

Get Entra ID / Azure AD properties for a group ...

Wed, 25 Feb 2026 10:22:49 +0000

Hello -

I'm looking for some guidance / clarity.

I'm running Adaxes 2023 (I know I need to update) and I have a very specific task I am trying to accomplish.

I am in hybrid-mode - so we have an on-premise AD that syncs to Entra ID (Azure AD).

My on-prem AD is managed and I have the M365 tenant configured under 'Cloud Services'.

I need to retrieve the Entra ID object ID for a subset of the groups in my domain.

I've been reading the online docs for hours now and I am a little lost.

If I understand correctly, it says I should be able to use the Adaxes powershell command 'get-AdmGroup' to retrieve the Entra ID object ID ... but I can't figure it out.

I've looked at the '-AdaxesService' command along with using my organization's '.onmicrosoft.com' domain name in the 'serverName' parameter, but I get an error saying that it is 'unavailable'.

I want to get the information in the easiest and most efficient manner ... and I thought it would be much easier with Adaxes.

I feel as if I am missing something here. Any and all help / direction is much appreciated (in advance).

Thanks.

Installing Adaxes 2026.1

Mon, 23 Feb 2026 15:17:09 +0000

Getting error during installation, Softwrra Adaxes 2026.1 Setup - Could not be installed. Verify that you have sufficent privileges to install system service.

the service account and my account both have local admin rights on the servers. Any help would be appreciated. Nothing in the event viewer that points toward an issue that I can find.

Adaxes very slow and laggy after integrating EXO

Mon, 23 Feb 2026 14:39:24 +0000

After connecting to Exchange Online, we can once again access the Exchange properties of users as usual. That works well.

However, we now have relatively long loading times when calling up users, creating distribution lists, and basically everything else. It can easily take 15-20 minutes.

Is there any way to check what is taking so much time here?

We are grateful for any ideas and suggestions.

How do I display an icon in a report specific column?

Fri, 20 Feb 2026 16:09:50 +0000

I have a report that displays the adaxes logs for a specific scheduled task initator. One of my report-specific columns runs the following script:

$logRecord = $Context.ReportItem.LogRecord
if ($logRecord -ne $NULL)
{
    $executionLog = $logRecord.GetExecutionLog()
    $firstError = $executionLog.FirstErrorEntry
    if ($firstError -ne $NULL)
    {
         <# Todo if $first error, show icon indicating error #>
    }    
}

I currently have the data type set to text. Is there any way in the PowerShell to access the icon from index 30 or something equivalnt to that? My goal is to have some sort visual when an error is thrown in the execution log.

Multiple domain names

Fri, 20 Feb 2026 09:58:38 +0000

I am currently trying to configure a client in Adaxes that has multiple domain names. They are already configured with a .nl address and that works fine. Now i want to add .de and .be. I followed the link below, but I still cannot get it to appear in the web interface. I would like us to have an option in the web interface to change the domain name when creating the user.

https://www.adaxes.com/help/ConfigureUPNSuffixSelection/

External Contact Self-Service

Thu, 19 Feb 2026 17:27:35 +0000

Hello!

I am wondering if there is a way for external contacts, with no active directory account on our end, to request to join or leave Distribution Groups?

Export of business units, find relevant membership rules

Wed, 18 Feb 2026 15:06:31 +0000

Hi team,

I hope you are doing well.

Do you happen to have a ready-to-use script or solution to export business units and their criteria?

I need to find business units where a specific OU is configured to include members of that OU or its sub-OUs.

Thanks