Thursday, November 1, 2012

Conditionally exporting Null values using IIF in FIM


I’m re-documenting this here so I don’t forget about it again.

FIM will not, under any circumstance, export a Null value as the result of an IIF statement in an outbound flow!

IIF is broken, and has been broken from the initial FIM release.  See Clear/delete attribute through Synchronization Rule and Using IIF to conditionally flow an authoritative attribute delete.

So I see three possible solutions to this problem.

  1. Classic coded sync rules for attributes with conditional export logic.
  2. Denormalize the metaverse so that all calculations can be performed inbound and the result stored in the metaverse, then use only direct export flows.
  3. (And the one I'm choosing at the moment) Perform a direct flow of a NullString attribute in the outbound flow to ensure that nulls are written.  Then add dependent sync rules for each condition that flow the calculated value when the condition is met.  This can be a bit messy to look at in FIM Service as dependent sync rules can only use logical AND when constructing the scope filters, so OR must be expressed as additional dependent sync rules, which can greatly increase the number of rules required.  In outbound flows, the last writer wins.  The null value in the parent rule is first.  If the condition is met, the dependent rule will write its value second, thus becoming the winning value that is exported.  When the condition ceases to be met the direct null value flow from the parent is allowed to win again and becomes the exported value.

UPDATE (2012.11.07)

Hotfix rollup 4.1.2548.0 from includes a fix to IIF.  I haven’t tested it yet, but good news for once on one of my FIM DCRs.


  1. Hi David,

    In this scenario, when the condition for the dependent sync rule is not met, do you transition out of the set and consequently remove the sync rule ?

    In my case, I remove the dependent sync rule when my object transitions out of the set , but FIM puts a delete-add for the object in AD MA export - this is messing my AD up.

    I just want to remove the dependent sync rule from the object.

    Did you face the same issue?


    1. Hotfix 4.1.2548.0 did fix the issue, so I can use IIF where needed. However, back when my config was still using the workaround I was using the new scope-based filter rules that came available with R2, not the classic MPR/Set/Workflow that were the only choice in 2010 RTM. So I don't deal with the FIM Service set transitions. All the changes happen in the sync engine.