We need to be able to manually change the servicePrincipalName value for certain ADMF serviceaccounts (gMSA) that are authorized via delegation.
If the servicePrincipalName value is omitted in the ADMF definition for the gMSA, ADMF will set the value to null.
This is not the case when creating definitions for ADMF users.
Proposal
I therefore propose a parameter for ADMF serviceaccounts named GroupProcessingMode with the possible values “Constraint” (default) or “Additive.”
This could also be implemented for ADMF 'users'. However, for backward compatibility, the default would have to be 'Additive'
We need to be able to manually change the servicePrincipalName value for certain ADMF serviceaccounts (gMSA) that are authorized via delegation.
If the servicePrincipalName value is omitted in the ADMF definition for the gMSA, ADMF will set the value to null.
This is not the case when creating definitions for ADMF users.
Proposal
I therefore propose a parameter for ADMF serviceaccounts named GroupProcessingMode with the possible values “Constraint” (default) or “Additive.”
This could also be implemented for ADMF 'users'. However, for backward compatibility, the default would have to be 'Additive'