# Ability to Move from one Disabled Lifecycle State to another without needing to make a user Active

**URL:** <https://developer.sailpoint.com/discuss/t/ability-to-move-from-one-disabled-lifecycle-state-to-another-without-needing-to-make-a-user-active/82440>\
**Category:** Idea Discussions\
**Tags:** identity-security-cloud, lifecycle-management\
**Created:** [September 22, 2024, 7:03pm UTC](https://developer.sailpoint.com/discuss/t/ability-to-move-from-one-disabled-lifecycle-state-to-another-without-needing-to-make-a-user-active/82440 "2024-09-22T19:03:50Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Mccarney](https://sea1.discourse-cdn.com/sailpoint/discuss/user_avatar/developer.sailpoint.com/mccarney/32/14953_2.png) [@Mccarney](https://developer.sailpoint.com/discuss/u/Mccarney)\
**Post date:** [September 22, 2024, 7:03pm UTC](https://developer.sailpoint.com/discuss/t/ability-to-move-from-one-disabled-lifecycle-state-to-another-without-needing-to-make-a-user-active/82440/1 "2024-09-22T19:03:50Z")

</div>

Hey Team,

I posted the below to the SailPoint Ideas Portal in 2021, the idea was marked as “Future Consideration” in 2023 but we haven’t seen anything to resolve this use case as of yet.

It got me thinking, how do other people handle this use case?

[https://ideas.sailpoint.com/ideas/GOV-I-1529](https://ideas.sailpoint.com/ideas/GOV-I-1529)

> # Ability to Move from one Disabled Lifecycle State to another without needing to make a user Active
> 
> Currently, in IDN, if there are multiple lifecycle states on a source that have a disable policy, If a user moves from one disabled state to another, nothing on the account will change. This doesn’t sound like a problem initially as the account is already disabled, so why would it need to be disabled again?
> 
> However, if there are any other account amendments set up in the provisioning policy, they will not be triggered.
> 
> This becomes an issue in the following use case:
> 
> Identity Profile has 3 lifecycle states:
> 
> Active: AD Account is Enabled and moved to Active OU
> 
> Leaver: Ad Account is Disabled and moved to Leaver OU
> 
> Suspended: Ad Account is Disabled and moved to Suspended OU
> 
> In this scenario, if a user is suspended and found to be innocent, changing the user’s lifecycle state back to Active will trigger the enable policy which will reactivate and move the AD account back to the Active OU.
> 
> However, if a user is suspended and found to be guilty, changing the user’s lifecycle state to Leaver from Suspended won’t trigger the disable policy as the user is already disabled which means the user will remain in the Suspended OU rather than moving to the Leaver OU.
> 
> The current work around is to manually reenable the account by manually changing the user’s lifecycle state from Suspended to Active, performing a full manual AD Aggregation, then manually setting the user lifecycle state to Leaver, which is quite convoluted.

Best Wishes

Ryan

---

<div class="post-metadata">

**Author:** ![ipobeidi](https://sea1.discourse-cdn.com/sailpoint/discuss/user_avatar/developer.sailpoint.com/ipobeidi/32/16000_2.png) [@ipobeidi](https://developer.sailpoint.com/discuss/u/ipobeidi)\
**Post date:** [September 23, 2024, 3:42pm UTC](https://developer.sailpoint.com/discuss/t/ability-to-move-from-one-disabled-lifecycle-state-to-another-without-needing-to-make-a-user-active/82440/2 "2024-09-23T15:42:14Z")

</div>

Ryan , you can achieve this with a Before Provisioning rule like the Standard services One

---

<div class="post-metadata">

**Author:** ![PhilRawlings1](https://sea1.discourse-cdn.com/sailpoint/discuss/user_avatar/developer.sailpoint.com/philrawlings1/32/37266_2.png) [@PhilRawlings1](https://developer.sailpoint.com/discuss/u/PhilRawlings1)\
**Post date:** [September 27, 2024, 12:14pm UTC](https://developer.sailpoint.com/discuss/t/ability-to-move-from-one-disabled-lifecycle-state-to-another-without-needing-to-make-a-user-active/82440/3 "2024-09-27T12:14:56Z")

</div>

Or via AC\_NewParent and ‘Account Update’. You just need to have a sync’d attribute changing on the source.  
I have 2 identity attributes  
Active Parent OU - where they should be  
Actual Parent OU - where they are,  
And then this logic to move them:

```auto
"value": "#if($activeParentOU != $actualParentOU)$activeParentOU#{else}#end",
                    "activeParentOU": {

```

---

<div class="post-metadata">

**Author:** ![Mccarney](https://sea1.discourse-cdn.com/sailpoint/discuss/user_avatar/developer.sailpoint.com/mccarney/32/14953_2.png) [@Mccarney](https://developer.sailpoint.com/discuss/u/Mccarney)\
**Post date:** [September 30, 2024, 9:39am UTC](https://developer.sailpoint.com/discuss/t/ability-to-move-from-one-disabled-lifecycle-state-to-another-without-needing-to-make-a-user-active/82440/4 "2024-09-30T09:39:06Z")

</div>

Interesting way to do it, I’ve recently started doing something similar, using AC\_NewParent and lifecycle states to move the user depending on their lifecycle state. However, you method is a catch all that avoids having to modify the transform if more lifecycle states are created.