# Active Directory

**URL:** <https://developer.sailpoint.com/discuss/t/active-directory/129125>\
**Category:** SHF Discussion and Questions\
**Tags:** workflows, access-profiles, roles, entitlements, sailpoint-identity-security\
**Created:** [May 15, 2025, 7:10pm UTC](https://developer.sailpoint.com/discuss/t/active-directory/129125 "2025-05-15T19:10:52Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![imranshaik786](https://avatars.discourse-cdn.com/v4/letter/i/77aa72/32.png) [@imranshaik786](https://developer.sailpoint.com/discuss/u/imranshaik786)\
**Post date:** [May 15, 2025, 7:10pm UTC](https://developer.sailpoint.com/discuss/t/active-directory/129125/1 "2025-05-15T19:10:52Z")

</div>

Hi everyone,  
I’m looking for guidance on how to set up a workflow in SailPoint Identity Now for an Active Directory source that removes user entitlements, access profiles when the identity’s lifecycle state changes to “terminated.”

as part of de-provisioning SailPoint disable AD account and remove some entitlements but not All the entitlements(Excluding the Primary groups like Domain Users).  
Has anyone implemented this? Would appreciate any help, examples, or JSON templates if available

---

<div class="post-metadata">

**Author:** ![suresh4iam](https://sea1.discourse-cdn.com/sailpoint/discuss/user_avatar/developer.sailpoint.com/suresh4iam/32/29513_2.png) [@suresh4iam](https://developer.sailpoint.com/discuss/u/suresh4iam)\
**Post date:** [May 15, 2025, 7:55pm UTC](https://developer.sailpoint.com/discuss/t/active-directory/129125/2 "2025-05-15T19:55:00Z")

</div>

Hey @imranshaik786 You can look at this article [Workflow to remove ALL leavers' standing access](https://developer.sailpoint.com/discuss/t/workflow-to-remove-all-leavers-standing-access/13025) which gives you different approaches using Workflow.

Hope this helps you.

---

<div class="post-metadata">

**Author:** ![vishal\_kejriwal1](https://sea1.discourse-cdn.com/sailpoint/discuss/user_avatar/developer.sailpoint.com/vishal_kejriwal1/32/10904_2.png) [@vishal\_kejriwal1](https://developer.sailpoint.com/discuss/u/vishal_kejriwal1)\
**Post date:** [May 15, 2025, 8:17pm UTC](https://developer.sailpoint.com/discuss/t/active-directory/129125/3 "2025-05-15T20:17:32Z")

</div>

check standard before provisiong rule.

---

<div class="post-metadata">

**Author:** ![SanjeevIAM](https://sea1.discourse-cdn.com/sailpoint/discuss/user_avatar/developer.sailpoint.com/sanjeeviam/32/21695_2.png) [@SanjeevIAM](https://developer.sailpoint.com/discuss/u/SanjeevIAM)\
**Post date:** [May 15, 2025, 9:38pm UTC](https://developer.sailpoint.com/discuss/t/active-directory/129125/4 "2025-05-15T21:38:16Z")

</div>

You should be able to achieve this using the standard before provisioning rule. In case you are looking to do this using a workflow here is a sample that should work for you.  
[LeaverRemoveAccess20250515.json](https://developer.sailpoint.com/discuss/uploads/short-url/1v1WJvIg3YT4i969ihdplYHbPuO.json) (2.6 KB)

---

<div class="post-metadata">

**Author:** ![PhilRawlings1](https://sea1.discourse-cdn.com/sailpoint/discuss/user_avatar/developer.sailpoint.com/philrawlings1/32/37266_2.png) [@PhilRawlings1](https://developer.sailpoint.com/discuss/u/PhilRawlings1)\
**Post date:** [May 19, 2025, 3:08pm UTC](https://developer.sailpoint.com/discuss/t/active-directory/129125/5 "2025-05-19T15:08:54Z")

</div>

Or run a powershell script directly on the computer that houses the AD that strips all access when the user becomes disabled

---

<div class="post-metadata">

**Author:** ![system](https://global.discourse-cdn.com/sailpoint/original/2X/f/f2136700ed5e3703e0b85e02f6be799dacca7735.png) [@system](https://developer.sailpoint.com/discuss/u/system)\
**Post date:** [July 18, 2025, 3:09pm UTC](https://developer.sailpoint.com/discuss/t/active-directory/129125/6 "2025-07-18T15:09:48Z")

</div>

Closed on July 18, 2025, 3:09pm UTC

This topic was automatically closed 60 days after the last reply. New replies are no longer allowed.