Azure AD application account aggregation task taking lot of time to complete

IdentityIQ (IIQ) IIQ Discussion and Questions
, ,
1

Which IIQ version are you inquiring about?

8.3p3

Please share any images or screenshots, if relevant.

[Please insert images here, otherwise delete this section]

Please share any other relevant files that may be required (for example, logs).

[Please insert files here, otherwise delete this section]

Share all details about your problem, including any error messages you may have received.

Azure AD application account aggregation task is taking approx. 6 hrs in production to complete, having around 70k users. We have used below ways to optimize the

  1. Disable optimization of unchanged accounts unchecked.
  2. Used partitioning

But the time taken by doing above changes did not impact the aggregation timing.

We have customization rule for this application and want to skip this rule if the account is optimized to reduce time. Is there any way we can find optimized accounts either through any API to use it skip accounts? Please suggest other ways by which we can reduce the aggregation time.

Thanks

2

Hi @MeghaB

You can try with checking Delta Aggregation option in your Account aggregation task

3

Hi @MeghaB

Did you try with Enable Delta Aggregation option checked?

2 Likes
4

Yes, we have tried enabling Delta aggregation as well but no impact.

5

Hi @MeghaB ,

Have you tried this suggestion?

image
image1473×403 40.8 KB

6

We haven’t tried this. Will try by adding this entry in application xml.
Thanks.

7

Could you please share the document name or link where this is mentioned. Also, more explanation is possible for this entry as how it works.

8

Hi @MeghaB

9

Hi @MeghaB, what options have you enabled in your Azure AD application? eg:

  • manage Exchange Online
  • manage O365 groups
  • manage access packages
  • etc.

Also, how many changed accounts are being detected?

We aggregate 68,000 accounts in about an hour.

10

Hi @paul_hilchey, we have not enabled any additional configuration like you mentioned. As per latest aggregation 19k changed accounts were detected out of 58k.

11

@MeghaB, that’s a lot of changed accounts. How often are you running an account aggregation?
Are you aggregating something that changes a lot, such as the last login time?

12

Are most accounts being optimized? You may want to set a logger for sailpoint.api.Aggregator to debug and tail the logs. It will tell you why the account is not getting optimized. You only need to keep logging on until you find the attributes that are suspect and you can disable the logging. Don’t do trace level it will be very noisy.