Microsoft Entra ID Provisioning: SelectUniqueValue and the "Apply this mapping" limitation

I agree that this limitation creates a gap in automated identity lifecycle management, especially in organizations using Workday as their authoritative HR system.

One important consideration is that username generation and identity updates should be treated as separate operations. A UPN that was valid during initial provisioning should not change simply because another candidate becomes available later.

I think an event-driven reevaluation option would be a practical improvement. The provisioning engine could detect changes to relevant source attributes, perform a fresh uniqueness check, and update the target only when the new value meets the configured naming policy.

Adding an approval option, audit history, and collision handling would also make this safer for enterprise environments.

It would be interesting to know whether Microsoft is considering this functionality for future provisioning improvements.