AD OU movement for Disable and Re-hire

Identity Security Cloud (ISC) ISC Discussion and Questions
,
1

I am having a requirement to move AD account to Disabled OU when identity is inactive. And move it back to normal user OU when Rehire.

Can someone help me with the steps i need to follow for this implementation.

2

@shikhadeliveroo you can use disable and enable provisioning policy

{
“name”: “disable Account”,
“description”: “string”,
“usageType”: “DISABLE”,
“fields”: [
{
“name”: “AC_NewParent”,
“transform”: {
“attributes”: {
“value”: “OU=disabled,DC=domain,DC=com”
},
“type”: “static”
},
“attributes”: {},
“isRequired”: false,
“type”: “string”,
“isMultiValued”: false
}
]
}

3

I can recommend you to use sailpoint service standard before provisioning rule as mentionned here : Services Standard Before Provisioning Rule - Identity Security Cloud (ISC) / ISC Discussion and Questions - SailPoint Developer Community

You should make request to your PS or Sailpoint support to deploy this rule in your tenant. Once D$deployed you can easlily configure the AD OU movement directly in your AD source configuration.

1 Like
4

Hello @shikhadeliveroo ,

You have two options to achieve this.

  1. Using BeforeProvisioning Rule
    As per https://community.sailpoint.com/t5/IdentityNow-Wiki/Best-Practices-Active-Directory-Account-Moves/ta-p/189661 SailPoint is recommending using BP rule. Deploying BP rule have dependency with support team as its a cloud rule.
  2. Using transforms in provisioning policies
    SailPoint is not recommending to use this approach as it will create stranded account activity (which I would not care as it will not create any technical problem). This approach doesn’t have any dependency. We are using this approach in our project.

For Option 1, you can take a look on the doc that I have shared where you will find sample BP rule or you can refer @baoussounda suggestion

For Option 2, you can create disable and enable type provisioning policies and apply the transform that @schattopadhy mentioned. You can use VS code for this. I have attached an example for your reference

image
image1146Ă—775 44.7 KB

image
image789Ă—739 36.7 KB

5

Is it supposed to work by updating DISABLE and ENABLE Provisioning policy only? It is not working for me :expressionless:

6

You can use Before provisioning as I describe above, because others policies rather than Create Account Policy generally not work as expected.

1 Like
7

Is the account being disabled and enabled with LCS changes?

8

We configure the Active Directory connector’s provisioning usage types so that during a Disable operation SailPoint sets the AC_NewParent attribute to the Disabled OU DN, and during an Enable operation it sets AC_NewParent to the normal Users OU DN. Since lifecycle events already drive Disable and Enable actions, this ensures accounts are moved to the Disabled OU on termination and moved back to the standard OU on rehire