AD Account Offboarding Best Practices

[ashwinnatarajan (Ashwin Kumar Natarajan)]

Hello,

We have a requirement to execute the following actions on the employee’s AD account as part of the offboarding process via ISC.

1. Remove the AD account from all AD groups.
2. Add the AD account to a Resignee AD group.
3. Move the AD account to the Disabled OU.
4. Disable the AD account.

Currently, we are using a Before Provisioning Rule to execute the first 3 actions above on the AD source. Disabling the AD account is configured in the Lifecycle State UI.

Is this the recommended approach or are there any potential risks or downsides in this? What’s the recommended approach to handle this scenario?

Thanks,

Ashwin

[lampard08 (Chelsea Blue)]

Hey Ashwin, Welcome to the community. BPR is great but another way is to handle the removal access from Lifecycle state and assign the new group using a role and move the OU using AC_NewParent in disable policy.

[vkashat (Vincent Kashat)]

This sounds like a good approach, are you using the Services Standard Before Provisioning rule? That way you wouldn’t need expert services to update it if needed.

[ashwinnatarajan (Ashwin Kumar Natarajan)]

Yes, I am using the Services Standard Before Provisioning Rule, however, I’ll have to submit a request to SailPoint Expert Services for rule review/deployment and update. Isn’t this the expected approach? Thanks.

[UjjwalJain]

Hi @ashwinnatarajan,

Please refer to this post if you need more information regarding Service Standard BP Rule:

Services Standard Before Provisioning Rule

Hello, An article in compass says that the Services Standard Before Provisioning Rule needs to be deployed for the partner but doesn’t say anything for the customer. Could anyone help me to understand how customers can get the “Services Standard Before Provisioning Rule”? Is this rule developed by sailpoint and made available to the customer? Is there any documentation on this rule? The rule on the below post is version 1.6.1. Is that the latest version of the rule, or is there any new versio…

[vkashat (Vincent Kashat)]

No, you don’t need expert services to deploy the rule, support can deploy it because it’s already approved for use in all tenants. The link @UjjwalJain left has a good answer as well.

[paul_hilchey]

Hi Ashwin,

A workflow may be a better approach.

[harshamin9 (Harsh Amin)]

Hello @ashwinnatarajan
Looks like majority of your questions have already got answered by our other experts
For AD/Azure AD the use of Services Standard is highlight recommended in conjunction with use of AC_NewParent.
And as Services Standard is a SailPoint created legacy Rule, you dont need ES to deploy it for you in the tenant, support can do it. You just might need to request version update incase the Service Standard Rule gets updates, as its totally SailPoint governed.

And all your use cases can be easily furbished with just eventConfiguration as its gonna simply utilise the Services Standard rule to complete those operations.