AD account and link from identity is deleting when triggering Leaver lifecycle event

AMANSINGH12 · September 8, 2026, 9:15am

When we are triggering leaver than that time AD account getting deleted from target and also link from identity. I don’t know why it is happning.

  if(null !=link){
      List accountRequestList = new ArrayList();
      for (Link link : links){
        String nativeId = link.getNativeIdentity();
        String appName = link.getApplicationName();
        Application application = context.getObjectByName(Application.class,appName);
        String applicationType = application.getType();
        if(applicationName.equalsIgnoreCase(appName)){
          List existingmemberOf = new ArrayList();
          Object memberOf = link.getAttribute("memberOf");						
          if(null != memberOf){
            if(memberOf instanceof List){
              existingmemberOf = (List)memberOf;
            }else{
              existingmemberOf.add(memberOf);
            }
          }
          for(int i=0;i&lt;existingmemberOf.size();i++){
            if(groupsToRetain.contains(existingmemberOf.get(i))){
              actualGroupsToRetain.add(existingmemberOf.get(i));
            }
          }
          AccountRequest accountRequest= new AccountRequest();
          //accountRequest.addArgument("sAMAccountName", sAMAccountName); 
          accountRequest.setOperation(AccountRequest.Operation.Disable);
          accountRequest.setApplication(appName);
          accountRequest.add(new AttributeRequest("dpUserAccountControl",ProvisioningPlan.Operation.Set,null));
          accountRequest.add(new AttributeRequest("dpUserCredentialsData",ProvisioningPlan.Operation.Set,null));
          accountRequest.add(new AttributeRequest("dpUserLogonPolicy",ProvisioningPlan.Operation.Set,null));
          accountRequest.add(new AttributeRequest("dpUserPublicKey",ProvisioningPlan.Operation.Set,null));
          accountRequest.add(new AttributeRequest("dpUserPayload",ProvisioningPlan.Operation.Set,null));
          accountRequest.add(new AttributeRequest("dpUserRecoveryKey",ProvisioningPlan.Operation.Set,null));
          accountRequest.add(new AttributeRequest("dpUserRecoveryKey",ProvisioningPlan.Operation.Set,null));
          accountRequest.add(new AttributeRequest("userAccountControl",ProvisioningPlan.Operation.Set,514));
          accountRequest.add(new AttributeRequest("IIQDisabled",ProvisioningPlan.Operation.Set,true));
          String disabledOU = getDisabledOU();
          if(null != disabledOU){
            accountRequest.add(new AttributeRequest("AC_NewParent",getDisabledOU()));
          }
          if(null != actualGroupsToRetain &amp;&amp; !actualGroupsToRetain.isEmpty()){
            accountRequest.add(new AttributeRequest("memberOf",ProvisioningPlan.Operation.Set,actualGroupsToRetain));
          }else{
            accountRequest.add(new AttributeRequest("memberOf",ProvisioningPlan.Operation.Set,null));
          }
          //set manager to null
          accountRequest.add(new AttributeRequest("manager",ProvisioningPlan.Operation.Set,null));
          accountRequest.add(new AttributeRequest("mobile",ProvisioningPlan.Operation.Set,null));
          accountRequest.add(new AttributeRequest("telephoneNumber",ProvisioningPlan.Operation.Set,null));
          //set decription 
          //Object objectTermination = identity.getAttribute("terminationDate");
       
          Calendar cal = Calendar.getInstance();
          cal.setTime(new Date());
          cal.setTime(cal.getTime());
          cal.add(Calendar.DATE,-1);
          cal.set(Calendar.HOUR_OF_DAY, 23);
          cal.set(Calendar.MINUTE, 59);
          cal.set(Calendar.SECOND, 59); 
          SimpleDateFormat format1 = new SimpleDateFormat("MM/dd/yyyy HH:mm:ss");
          Object objectTermination = format1.format(cal.getTime());
         
          String description = null;
          if(null != objectTermination){							
            description = "User Account Disabled. Termination Date " + objectTermination;							
          }
          if(null == description){
            String dateStr = Util.dateToString(Util.baselineDate(new Date()),"dd/MM/yyyy");
            description = "User Account Disabled. Termination Date "+dateStr;
          }
          accountRequest.add(new AttributeRequest("description",ProvisioningPlan.Operation.Set,description));
          accountRequest.setNativeIdentity(nativeId);						
          accountRequestList.add(accountRequest);	
          Custom custom = context.getObjectByName(Custom.class, "Custom-Common-ApplicationReference");
          //System.out.println("custom : " +custom.toXml());
          //List webservice = custom.get("webservice");
          //System.out.println("webservice : " +webservice);
            List webserviceDelete = custom.get("webserviceDelete");
          System.out.println("webserviceDelete : " +webserviceDelete);
		      List webserviceDisable = custom.get("webserviceDisable");
          System.out.println("webserviceDisable : " +webserviceDisable);
          List JDBC = custom.get("JDBC");
          //System.out.println("JDBC : " +JDBC);
          List ADapplication = custom.get("ADapplication");
          //System.out.println("ADapplication : " +ADapplication);
          //List links = identity.getLinks();            
          System.out.println("links : " +links);
          for(Link link : links){
            accountRequest= new AccountRequest();
            System.out.println("link.getApplicationName() : " +link.getApplicationName());
            String appName = link.getApplicationName();
            Application application = context.getObjectByName(Application.class,appName);
            String applicationType = application.getType();
          if(webserviceDisable.contains(link.getApplicationName())){
 
    String reqRefNum = generateReqRefNum();
 
    accountRequest.setOperation(

        ProvisioningPlan.AccountRequest.Operation.Disable);
 
    accountRequest.setNativeIdentity(link.getNativeIdentity());

    accountRequest.setApplication(link.getApplicationName());
 
    accountRequest.add(

        new AttributeRequest(

            "ReqRefNum",

            ProvisioningPlan.Operation.Remove,

            reqRefNum));
 
    accountRequestList.add(accountRequest);
 
    System.out.println("Disable Plan : "

        + link.getApplicationName());
 
}

else if(webserviceDelete.contains(link.getApplicationName())){
 
    String reqRefNum = generateReqRefNum();
 
    accountRequest.setOperation(

        ProvisioningPlan.AccountRequest.Operation.Delete);
 
    accountRequest.setNativeIdentity(link.getNativeIdentity());

    accountRequest.setApplication(link.getApplicationName());
 
    accountRequest.add(

        new AttributeRequest(

            "ReqRefNum",

            ProvisioningPlan.Operation.Remove,

            reqRefNum));
 
    accountRequestList.add(accountRequest);
 
    System.out.println("Delete Plan : "

        + link.getApplicationName());
 
}
 
            else if(JDBC.contains(link.getApplicationName())){
              System.out.println("Plan in side JDBC *********" +plan.toXml());
              accountRequest.setOperation(ProvisioningPlan.AccountRequest.Operation.Disable);
              accountRequest.setNativeIdentity(link.getNativeIdentity());
              accountRequest.setApplication(link.getApplicationName());
              String userId = link.getNativeIdentity();
              System.out.println("userId JDBC *********" +userId);
              accountRequest.add(new AttributeRequest("USER_ID",ProvisioningPlan.Operation.Remove,userId));
              accountRequestList.add(accountRequest);
              accountRequest = null; 
              userId = null;
            }
     //  else if(ADapplication.contains(link.getApplicationName())){
             // accountRequest.setOperation(ProvisioningPlan.AccountRequest.Operation.Disable);
            //  Kishore
              //accountRequest.setApplication("IIQ");
       //       accountRequest.setApplication(link.getApplicationName());
         //     accountRequest.setNativeIdentity(link.getNativeIdentity());
           //   accountRequestList.add(accountRequest);
             // accountRequest = null;
              //system.out.println("Plan in side ADapplication *********" +plan.toXml());
           // }
            /*
            else if("DelimitedFile".equalsIgnoreCase(applicationType)){
              AccountRequest accountRequest = new AccountRequest();
              accountRequest.setOperation(AccountRequest.Operation.Disable);
              accountRequest.setApplication(appName);	
              accountRequest.setNativeIdentity(link.getNativeIdentity());
              accountRequestList.add(accountRequest);
              System.out.println("ad done delimitedfile : " +accountRequestList);
            }
            */
          }
          custom = null;
          webservice = null;
          JDBC = null;
          ADapplication = null;
        } 
        /*
        else{
          llogger.debug("application other than Active directory : "+appName);
          Application application = context.getObjectByName(Application.class,appName);
          String applicationType = application.getType();
          if(!"DelimitedFile".equalsIgnoreCase(applicationType)){
            AccountRequest accountRequest = new AccountRequest();
            /*	
            if("Oracle Database - Direct".equalsIgnoreCase(applicationType)){
							accountRequest.setOperation(AccountRequest.Operation.Modify);
							accountRequest.add(new AttributeRequest("ACCOUNT_STATUS",ProvisioningPlan.Operation.Set,"EXPIRED &amp; LOCKED"));
							accountRequest.add(new AttributeRequest("IIQDisabled",ProvisioningPlan.Operation.Add,true));
							accountRequest.add(new AttributeRequest("IIQLocked",ProvisioningPlan.Operation.Add,true));							
						}else{						
							accountRequest.setOperation(AccountRequest.Operation.Disable);
						}*/
        /*
            accountRequest.setOperation(AccountRequest.Operation.Disable);
            accountRequest.setApplication(appName);	
            accountRequest.setNativeIdentity(nativeId);
            accountRequestList.add(accountRequest);					
          }
        }
        */
        if(null != accountRequestList &amp;&amp; !accountRequestList.isEmpty()){
          plan.setAccountRequests(accountRequestList);
        }
        plan.setIdentity(identity);
        /*}*/
      }

punna0001 · September 8, 2026, 9:31am

Welcome back, Aman. I would first check this branch in your rule:

else if (webserviceDelete.contains(link.getApplicationName())) {
    accountRequest.setOperation(
        ProvisioningPlan.AccountRequest.Operation.Delete);
}

Your nested for(Link link : links) processes all links again. If the AD application reaches webserviceDelete, this could create a Delete request for that AD account.

Since this is if / else if, also check webserviceDisable. If AD is matched there first, the Delete branch should not run. I would log the completed plan after setting the requests:

plan.setAccountRequests(accountRequestList);
plan.setIdentity(identity);
System.out.println("Final plan: " + plan.toXml());

Then check the same transaction under Administrator Console → Provisioning and confirm whether the AD AccountRequest is op="Disable" or op="Delete".

If you see Delete, check Custom-Common-ApplicationReference and verify how the AD application is mapped in webserviceDelete and webserviceDisable. If the first block is already handling AD as Disable, it may also be worth excluding AD from the second loop so the same link is not processed twice.

The predefined OOTB Leaver normally disables accounts (Using Lifecycle Manager). If this rule only produces Disable, I would then check the remaining Leaver/Rapid Setup configuration, since Rapid Setup can also be configured to delete accounts (Using Rapid Setup).

AMANSINGH12 · September 8, 2026, 10:48am

But webservice delete conatins only webservice related application not AD application.

punna0001 · September 8, 2026, 12:44pm

Thanks, Aman. If webserviceDelete contains only Web Services applications, then that branch does not appear to explain the AD deletion. I would check this next:

accountRequest.add(
    new AttributeRequest("AC_NewParent", getDisabledOU()));

AC_NewParent moves the AD account to another OU and does not delete it.

Please check:

Does the account still exist in the Disabled OU?
Is that OU included in the AD Account/User Search Scope?
Does the Link disappear only after aggregation?
In Administrator Console → Provisioning, if the transaction is logged, does the AD request show Disable or Delete?

If the account still exists but the Link disappears after aggregation, check the Search DN scope and Detect deleted accounts. An account moved outside the configured scope will not be returned by aggregation. If the AD object itself is actually deleted but the request shows only Disable, then I would check the AD provisioning rules, IQService scripts, and any AD-side automation.

ryan_toornburg · September 8, 2026, 7:31pm

Hi @AMANSINGH12 - is the AD account actually deleted or is it just being removed from IIQ? I see you move it to the disabled users OU. If the Ad connector is not configured to read from the disabled OU, IIQ will not see it and remove it from the cube.

AMANSINGH12 · September 9, 2026, 6:51am

Thanks for reply. Its deleting .

ryan_toornburg · September 9, 2026, 6:15pm

@AMANSINGH12 - in your Provisioning transaction log do you see a Delete Event for those users? If so, what is the source listed?
Example:

Topic		Replies	Views
AD accounts are deleting after leaver workflow triggered IIQ Discussion and Questions workflows , identityiq	3	43	September 9, 2026
AD account delete IIQ Discussion and Questions workflows , rules , identityiq , provisioning	7	277	March 24, 2025
Handling Leaver Process Exception When AD Account is Already Deleted IIQ Discussion and Questions workflows , identityiq	7	226	November 6, 2025
Leaver to ensure all user accounts are disabled IIQ Discussion and Questions workflows , identityiq , provisioning	3	242	March 24, 2025
AD account delete after 90 days of termination SHF Discussion and Questions identity-security-cloud	8	852	July 8, 2024

AD account and link from identity is deleting when triggering Leaver lifecycle event

Related topics