Authoritative source having two accounts for same user, how to select only one?

[ninfante (Nicolás Infante)]

Hi everyone!

Hope you all are doing well.
Currently we’re having an issue where the authoritative source has two accounts for the same user. The first one is disabled and the new one is enabled, and as SailPoint is reading both, it often causes issues disabling the identity and the accounts, etc.
My question is, is there a way to tell SailPoint which account to use? Like some priority over the other, or something like that?
We don’t really want to use a filter because we’re worried about having orphaned identities if the auth source first deletes the account before creating the new record.

Thank you all in advance!

[sunnyajmera]

Have you tried looking at using the identity profile priority.

[ninfante (Nicolás Infante)]

Hi! Thank you for answering, and yes! But both accounts come from the same source, so this wouldn’t be valid on this case.

[RAKGDS (Rakesh Bhati)]

Hi Nicolas,
This is not a good practice to have 2 accounts with same user, one is disabled and other is enabled. We also had this and the issue we saw that any account will be picked during account aggregation and as the accountID is unique it may be either enabled or a disabled account.

To rectify this issue what we did is made sure that we have only one account coming from authorative source. IDN is not good at handling this issue.

Thanks
Rakesh Bhati

[sunnyajmera]

Take a look at:

Converting Contractors to Full-Time (identities conversing identity profiles)

Background: It’s reasonable to expect most companies do not have a unified workforce management source. In the case for non-employees wether it be Contractors or Interns, there’s a general contract for conversions wether it be Contractor to Full-Time, and in rare cases the inverse. In these scenarios, different sources are used to aggregate worker types and thus requires multiple identity profiles to onboard each member into Sailpoint. The challenge with Sailpoint then becomes a problem with id…

May be you should explore creating transforms for such attributes.

[colin_mckibben]

@RAKGDS

This is not a good practice to have 2 accounts with same user

I second what Rakesh is saying, but if you are unable to remove those duplicate accounts for some reason, then there may be another solution. What type of source is your authoritative source? Active Directory, Workday, … ? I ask because some connectors have the ability to filter the accounts that are aggregated through an option called filterString. If your source connector supports it, and there is an account attribute we can key off of that indicates if the account is enabled/disabled, then we could potentially filter out the disabled accounts.

[MVKR7T (Krishna Mummadi)]

Your scenario is totally make sense, nothing wrong with that. A user will have multiple accounts in some HR products. I have faced same scenario in SuccessFactors.

1. You can filter accounts from Authoritative source while aggregation if it is ok to not to read that account at all, but it might have consequences like you might not know when a user gets disabled and if it doesn’t have one more account.

IdentityNow Account Filtering during Account Aggregation - Compass (sailpoint.com)

2. If you need to have both accounts (enabled, disabled) in Identity, then update your transforms (Account Attribute) to read enable account data using filter attributes accountPropertyFilter, check the optional attributes in Transform.

Account Attribute | SailPoint Developer Community

Hope this helps.

Thanks
Krish