Manager Field in AD – Handling Distinguished Name

Hello,

We are implementing AD provisioning for our users. We noticed that the manager field in Active Directory requires the distinguishedName (DN) of the manager’s account.

Currently, the attribute msDistinguishedName is not populated, which makes it impossible to fill the manager field during provisioning. We also have OU moves that are sometimes done directly in AD, which complicates things further.

Our goal is to:

Retrieve the current AD distinguishedName for each user
Store it in an identity attribute (msDistinguishedName)
Use this attribute to correctly populate the manager field during AD provisioning

What is the best approach to achieve this? Should we try to compute the DN in the outbound mapping rule, or prefill it beforehand?

Thanks for your advice.