How to import (sync) users from Active Directory as "disabled"?

Configuring the server
1

Hey, i’m new to this forum and was working with Keycloak for a short while.
I added an Active Directory federation source to my realm and it syncs users from a specific AD-group very well. But to gain a specific workflow i would like them to be imported as disabled by default. I see there is a switch in each users record of Keycloak, named “User Enabled”. This switch is set to “ON” by default, and i wonder how to have it “OFF” by default.
My reason is that i like to approve users first before giving them the possibility to login into my application.

Thanks for any help!

2

I’m also trying to import AD users as disabled. I created a hard-coded-attribute-mapper to set enabled user attribute to false. The user starts out disabled, but it is difficult to enable. It the attribute seems to get set back to false anytime the account is accessed. It would be great to either have an options in ldap settings to set new users enabled = false or add an option to the hard-coded-attribute-mapper to only apply the attribute to a user upon its creation in keycloak.