AD OU movement for Disable and Re-hire

Identity Security Cloud (ISC) ISC Discussion and Questions
,
1

I am having a requirement to move AD account to Disabled OU when identity is inactive. And move it back to normal user OU when Rehire.

Can someone help me with the steps i need to follow for this implementation.

2

@shikhadeliveroo you can use disable and enable provisioning policy

{
“name”: “disable Account”,
“description”: “string”,
“usageType”: “DISABLE”,
“fields”: [
{
“name”: “AC_NewParent”,
“transform”: {
“attributes”: {
“value”: “OU=disabled,DC=domain,DC=com”
},
“type”: “static”
},
“attributes”: {},
“isRequired”: false,
“type”: “string”,
“isMultiValued”: false
}
]
}

3

I can recommend you to use sailpoint service standard before provisioning rule as mentionned here : Services Standard Before Provisioning Rule - Identity Security Cloud (ISC) / ISC Discussion and Questions - SailPoint Developer Community

You should make request to your PS or Sailpoint support to deploy this rule in your tenant. Once D$deployed you can easlily configure the AD OU movement directly in your AD source configuration.

4

Hello @shikhadeliveroo ,

You have two options to achieve this.

  1. Using BeforeProvisioning Rule
    As per https://community.sailpoint.com/t5/IdentityNow-Wiki/Best-Practices-Active-Directory-Account-Moves/ta-p/189661 SailPoint is recommending using BP rule. Deploying BP rule have dependency with support team as its a cloud rule.
  2. Using transforms in provisioning policies
    SailPoint is not recommending to use this approach as it will create stranded account activity (which I would not care as it will not create any technical problem). This approach doesn’t have any dependency. We are using this approach in our project.

For Option 1, you can take a look on the doc that I have shared where you will find sample BP rule or you can refer @baoussounda suggestion

For Option 2, you can create disable and enable type provisioning policies and apply the transform that @schattopadhy mentioned. You can use VS code for this. I have attached an example for your reference

image
image1146Ă—775 44.7 KB

image
image789Ă—739 36.7 KB

5

Is it supposed to work by updating DISABLE and ENABLE Provisioning policy only? It is not working for me :expressionless:

6

You can use Before provisioning as I describe above, because others policies rather than Create Account Policy generally not work as expected.

7

Is the account being disabled and enabled with LCS changes?

8

We configure the Active Directory connector’s provisioning usage types so that during a Disable operation SailPoint sets the AC_NewParent attribute to the Disabled OU DN, and during an Enable operation it sets AC_NewParent to the normal Users OU DN. Since lifecycle events already drive Disable and Enable actions, this ensures accounts are moved to the Disabled OU on termination and moved back to the standard OU on rehire

9

yes, AD is getting disabled on LCS change

10

Hello @shikhadeliveroo ,

Following are the detailed steps you need to follow.

Flow 1 –> When User moves from active to disable LCS (Leaver scenerio)

  1. Create an LCS state named as Active and Disable
  2. In the Disable LCS state, mark the AD source as part of “Disable Account“ config.
  3. In AD, create an policy of “Disable Account“ and configure AC_NewParent and assign it with static value of OU in which you have to place the user when the identity gets Disabled

Flow 2 –> When User moves from disable to active LCS (Rehire Scenerio)

  1. Create an LCS state named as Active and Disable
  2. In the Active LCS state, mark the AD source as part of “Enable Account“ config.
  3. In AD, create an policy of “Enable Account“ and configure AC_NewParent and assign it with static value of OU in which you have to place the user when the identity gets Enabled

This is simplest way to achieve this OU movement.

Thank You,

Regards,

Rohit Wekhande.

11

AC_NewParent is inbuilt or we need to configure anywhere?

12

Hello @shikhadeliveroo ,

Its a Built in Attribute.

When we pass this attribute to MS AD, AD comes to know that OU of the user has to be changed.

Refer the below sample of how you need to configure in Disable Account Policy or Enable Account Policy of AD.

The below is the same DISABLE ACCOUNT Policy for AD where you can find “AC_NewParent“ attribute. This where you configure it in ISC and no need to do anything in AD.

{
      "name": "Account Disable",
      "description": null,
      "usageType": "DISABLE",
      "fields": [
        {
          "name": "AC_NewParent",
          "transform": {
            "attributes": {
              "value": "OU=Disable,OU=Resources,DC=test,DC=domain,DC=com"
            },
            "type": "static"
          },
          "attributes": {},
          "isRequired": false,
          "type": "string",
          "isMultiValued": false
        }
      ]
    }
13

This worked, Thanks!

14

Hi Rohit, In Flow 1, eventhough we have step 2, the account enable and disable part is not consistent, what could be the reason. Do we have to handle that as well part of BP rule? if so how?

15

Hello @lalithajay ,

Welcome to SailPoint Developer Forum!

This is weird as its an OOTB behavior. Can you please elaborate on what exact issue you are facing? Is it like when an identity is moving to Disabled“ LCS state, the Disable Account event is not getting triggered, is it the case?

Regards,

Rohit Wekhande.

16

Thanks Rohit, The OU movements working fine via BP rule. but we had additional rules to enable disable AD accounts in addition to the things configured in Identity profile area for life cycle states. Now all sorted. Thanks for your reply. Indicating OOTB the behaviour should be based the life cycle state mapping.