> For the complete documentation index, see [llms.txt](https://docs.aohwv.dev/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.aohwv.dev/feature-reference/connectors/machine-identity-rules.md).

# Machine Identity Rules

The MI Rules tab lets you define rules that automatically classify incoming accounts as Machine Identities — such as service accounts or system users — before they are classified in AOH Sync.

## Where this data comes from

Rules are evaluated against each incoming record during a Sync. The source data is the same row your Connector reads from the Source System. When a record's User Principal Name (UPN) matches a rule's pattern, AOH Sync classifies that record as a Machine Identity instead of a standard Account — the original Source System data is unchanged.

![The MI Rules tab for AOH Test AD → CloudSync (Delta), showing an empty rules list and a New Rule form with Rule Type set to UPN Regex, a regex pattern, a Classification label, a Priority field, and an Enabled toggle](/files/l0ISkriB90YJf18blG2i)

*The MI Rules tab shows your active classification rules on the left and a form to add a new rule on the right.*

## What you can do here

| Action                        | What it does                                                                                                                                            |
| ----------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------- |
| New rule — Rule type selector | Chooses the matching method for the rule. The available type shown is **UPN regex** (case-insensitive match against the User Principal Name).           |
| UPN regex field               | Enter the regular expression pattern to match against incoming UPN values (for example, `^svc[-_].+` to catch any UPN starting with `svc-` or `svc_`).  |
| Classification field          | A free-text label applied to every account matched by this rule (for example, service\_account). This label is stored with the Machine Identity record. |
| Priority field                | A numeric value that controls the order in which rules are evaluated. Lower numbers are evaluated first.                                                |
| Enabled toggle                | Activates or pauses a rule without deleting it.                                                                                                         |
| Add rule button               | Saves the new rule and adds it to the active list.                                                                                                      |

## How to use it

{% stepper %}
{% step %}
**Identify your machine account patterns**

Review your Source System's user population and identify naming conventions used for service accounts, system accounts, or non-human identities (for example, UPNs beginning with `svc-`, `app-`, or `bot-`).
{% endstep %}

{% step %}
**Set the Rule type**

Select **UPN regex** from the Rule type dropdown. This matches accounts by their User Principal Name using a case-insensitive regular expression.
{% endstep %}

{% step %}
**Enter the regex pattern**

Type your pattern in the **UPN regex** field. For example, `^svc[-_].+` matches any UPN that starts with `svc-` or `svc_` followed by one or more characters.
{% endstep %}

{% step %}
**Add a Classification label**

Type a descriptive label in the **Classification** field (for example, service\_account). This label is stored with the Machine Identity record and helps you identify these accounts in AOH Sync.
{% endstep %}

{% step %}
**Set priority and enable the rule**

Enter a **Priority** number. If you have multiple rules, lower numbers are evaluated first — the first match wins. Toggle **Enabled** on, then click **Add rule**.
{% endstep %}
{% endstepper %}

{% hint style="info" %}
When no rules are defined, every incoming account is treated as a human Identity. Rules only affect records processed after the rule is saved and enabled — existing records are not reclassified retroactively.
{% endhint %}

## Related

* [Identities, Accounts & Users](/core-concepts/identities-accounts-users.md)
* [Field Mappings](/feature-reference/connectors/field-mappings.md)
* [Connector Overview](/feature-reference/connectors/overview.md)
* [Connectors](/feature-reference/connectors.md)


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.aohwv.dev/feature-reference/connectors/machine-identity-rules.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.