Moving user accounts and authenticators

1. A domain must be selected for a user account when it is created, as the domain is part of uniquely identifying the account. An authenticator record assigned to a user account must belong to the same domain as the user account. You therefore need to ensure that the correct numbers of authenticator records are allocated to the different domains.
2. An authenticator record assigned to a user account must belong to the same organizational unit as the user account. If an authenticator record is assigned to a user account in another organizational unit, it is moved to that organizational unit automatically.
3. A user account can be moved to a different domain. Any assigned authenticators are moved along with the user account.
4. Unassigned authenticator records can be moved to the required domain after import.
5. An authenticator record assigned to a user cannot be moved. User accounts can be moved between organizational units within the same domain whenever required. In that case, the assigned authenticator records are automatically moved along.

Figure: Moving user accounts and authenticators

When a user account is moved to an organizational unit, all authenticator records assigned to it are moved along.

An authenticator record assigned to a user account cannot be moved—the user account must be moved.