Lifecycle & Access Governance
Move OU
Move a person's Active Directory account to another OU, now or on a date, with a justification on the record.
Completes when the account moves to the new OU after approval, at the scheduled time, with its previous OU stored.
https://mcp.avatier.com/mcp
Ask in Plain Language
Run Move OU from the AI Assistant You Already Use
Your Lifecycle Management approval workflow decides who approves, with identity verification first in Avabot and MCP, where every move is filed as a request. One completed OU move = one Secure Outcome; failed attempts are never billed.
You: Move Taylor Brooks to the Sales OU. Justification: joined the regional sales team. Avatier: verify: passed · account: Active Directory · OU: picked from matches · request: submitted, may need approval
Why it matters
Where an Account Sits Should Follow a Request.
Moving an account between OUs is a change to the directory, so who asked, why and where it went belong on the record.
What a move needs
The person's Active Directory account, an existing destination OU in that domain, a time, and a justification.
What goes wrong by hand
Moving accounts between OUs by hand leaves no request, no approval and no record of where the account was before.
What Move OU does
It shows the current OU, finds the destination as you type part of its name, accepts only an existing OU, and stores the previous OU when the move runs.
What per-seat pricing charges
Per-seat IAM charges for every licensed seat, whether anyone moves OU this month or not. Pay Per Identity Action™ charges only for completed OU moves.
The Action
How Move OU Runs
On the web, Move OU walks through these screens. In Avabot and MCP you verify, name the person, pick from the matching OUs, give a justification and confirm.
Verify in Avabot or MCP
Avabot and MCP only. Move OU starts with identity verification in the conversation, with the methods your policy already allows. On the web there is no extra check beyond your sign-in. By default, Move OU does not need a fresh verification.
Identity Verification (Avabot and MCP)
Select the User
Pick the system and search for the person: someone you're authorized to request for. Workflow admins are then asked "Would you like to use workflow?"
Set the Schedule
Choose Update Now, a date and time, or a number of days, hours and minutes from now, and enter a Justification. A workflow admin who skips workflow goes straight to the OU choice.
Pick the OU
The current OU is shown. Type part of the destination OU name and pick it from the matching list. Text that doesn't match an existing OU is rejected.
Continue
On the workflow path, choose Continue to submit. The move is recorded in Request History with a Request ID and goes through your Lifecycle Management approval workflow, where the approver sees the current and new OU.
Approval point
Available on Web, Mobile, Teams, Avabot chat and MCP.
Avabot chat and MCP require the current (.NET 10) Avatier server.
In Avabot chat and MCP, Move OU works on Active Directory accounts only and can't be scheduled: the request runs as soon as it is approved.
Secure Outcome
What Counts as Done
A Secure Outcome is a completed, verified, policy-compliant identity action. An OU move completes when the approved request runs at the scheduled time: the account moves to the new OU and its previous OU is stored. One completed OU move = one Secure Outcome.
Evidence
- A Request ID in Request History (filter Move OU, exportable)
- The approver's view, showing the current and new OU
- An activity-log entry
Guardrails
Your Assistant Asks. Avatier Decides.
Verified First
Avatier verifies the person before sensitive changes, with the methods your policy already allows.
Acts as the Signed-In User
OAuth sign-in to your own tenant. No shared service account, no API key to manage.
Never Makes Up Values
The connector only sends what the person actually said, and asks when something is missing.
Every Request Recorded
Requests land in Request History, ready to review and export.
Pay Per Identity Action™
Pay per Completed OU Move
Pay per completed OU move. Failed attempts are never billed.
| Compared | Manual or Per-Seat IAM | Move OU, Pay Per Identity Action™ |
|---|---|---|
| What you pay for | Every licensed seat, whether it acts or not | Completed OU moves only |
| Failed attempts | No line between an attempt and a result | Attempts, failures and retries are never billed |
| The work | Manual intervention or tickets | Once approved, the account moves to the new OU at the scheduled time, and its previous OU is stored |
| Evidence | Silent failures and missing audit trails | A Request ID in Request History and an activity-log entry |
Pay Per Identity Action™ is in invitation-only preview. Pricing is shared with qualified organizations.
Works with the Directory Move OU Touches
Move OU works with Active Directory organizational units only. For accounts on directories without OUs, such as Okta, the web app says it isn't supported and Avabot declines.
- Microsoft
- Active Directory organizational units in the user's domain. Moving to Entra ID administrative units is not offered.
Avatier MCP
New to Avatier MCP?
The Model Context Protocol is an open standard, stewarded by the Linux Foundation, that lets AI assistants call real systems through connectors instead of custom integrations.
Up and Running in Under a Minute
One URL works in every MCP client. Pick yours, copy, paste, sign in.
Microsoft Copilot Studio
Claude Code
OpenAI Codex
Cursor
Frequently Asked Questions
Can Move OU be used for Entra ID or Okta users?
No. It works with Active Directory organizational units; for other directories the web app says it isn't supported and Avabot declines.
Can I schedule the move?
Yes, on the web: now, a specific date and time, or a number of days, hours and minutes from now. In Avabot the request runs as soon as it is approved.
How do I pick the destination?
Type part of the OU name and choose from the matching OUs in the user's domain. Only existing OUs are accepted.
Does Avatier provide AI-driven compliance reporting?
Yes. Avatier turns continuous identity and access data into audit-ready reports on demand, using AI to assemble who has access to what, what changed, and who approved it, mapped to the controls auditors expect. Instead of a manual evidence scramble before each audit, you generate plain-language, exportable reports covering SOC 2 Type II and ISO 27001, plus the evidence needs associated with NIST, SOX, HIPAA, and GDPR.
What is AI-driven configuration?
Avatier's AI-driven config turns plain-language intent into working policy. Rather than hand-coding rules, connectors, and roles, administrators describe what they need and Avatier recommends and sets up provisioning rules, role mappings, and workflows, then validates them before they go live. It shortens deployment from months to days and keeps configuration consistent, auditable, and free of custom scripting.
What is Pay Per Identity Action™?
Pay Per Identity Action™ is Avatier's pricing mechanic. Customers pay only for completed, verified, policy-compliant identity actions, called Secure Outcomes.
Is it the same as pay-per-action advertising?
No. Pay per action (PPA) is performance-marketing vocabulary for paying when an ad converts. Pay Per Identity Action™ charges for completed identity work.
How do I get started?
Getting started is free, deployment services are included, and a 45-day money-back guarantee applies. Contact Avatier for pricing for your organization.
What is MCP?
The Model Context Protocol is an open standard, stewarded by the Linux Foundation, that lets AI assistants call real systems through connectors instead of custom integrations.
How is it billed?
Pay Per Identity Action™ is in invitation-only preview: each completed, verified action is one Secure Outcome, and attempts, failures and retries are never billed.
Move OU
You've Automated the System. Now Secure the Lifecycle.
Pick the destination OU, give a reason, and the move is recorded in Request History with a Request ID.