Hi All, We have provisioning policy to disable and move AD account to disable OU. In sandbox when lifecycle state change to inactive I see a disable event and moving ad account to disable OU, in production when lifecycle state change to inactive I see disable event for 1 or 2 accounts those account…

Are those accounts still shown as “enabled” in ISC?

Hi Nithesh, When HR receive notice there is a different process first disable AD account and after 1 hours HR will terminated in their system and that will receive to ISC by that time frame there will be AD aggregation that will disable in ISC.

That’s the issue. If those accounts are aggregated from AD before corresponding identities getting updated from HR system, the AD accounts will be already in disabled state when the LCS changes. Hence no action will be taken by ISC to disable these already disabled accounts.

I see daily some accounts moving to disabled OU, but I will verify again. What other option we have to move to disabled OU. Thank you

It seems like a competition between Account Aggregations of AD and HR system. To handle such a situation, you could set up a Workflow that is triggered when LCS changes and then checks the account status in AD. If the account is already disabled, then enable the same and then using SSI BP rule, cha…

For business reason AD accounts are disabling right away through different process and don’t want to enable back.

[image] Nithesh Rao: then using SSI BP rule, change the operation to disable They will not be enabled as you will be changing the operation back to disable in BP rule

Thank you Nithesh, do you have workflow template?

[image] Account not disabled after user moved in AD ISC Discussion and Questions You can create Provisioning Policy forms through Postman or VSCode. It’s convenient with VSCode, just goto sources → expand your source → click + sign next to Provisioning Policie…

Hi Chaithanya, With the recent identity profile update now for each identity state we have option to enable or disable account by selecting source, while testing to disable AD account for leaveofabsence users with the existing provisioning policy I attached it is disabling AD account and moving to…

AD provisioning Policy not Moving to Disabled OU

Identity Security Cloud (ISC) ISC Discussion and Questions

chaithu979 (CHAITHANYA M) July 11, 2025, 8:09pm 10

Topic		Replies	Views
AD OU movement for Disable and Re-hire ISC Discussion and Questions rules , identity-security-cloud	15	312	February 13, 2026
Account not disabled after user moved in AD ISC Discussion and Questions identity-security-cloud	14	517	March 4, 2025
Move AD Account that's already disabled to different OU ISC Discussion and Questions	6	1619	March 30, 2023
Disable and Move AD account Based on LCS ISC Discussion and Questions identity-security-cloud , provisioning	20	312	March 20, 2026
AD account moves for Disabled Accounts ISC Discussion and Questions	5	4883	March 10, 2023

AD provisioning Policy not Moving to Disabled OU

Related topics