Best Practice Clarification – Deprovisioned LCS and checkDeletedDisabled flag

Hello Lalitha, just to make sure I understood your concern correctly, you are mainly trying to avoid keeping a large number of inactive identities if they are going to add load to refresh or internal processing, right?

If so, I would still go withcheckDeletedDisabled=true here.

That way, the disabled account stays tied to the same identity instead of moving into the uncorrelated bucket and becoming another cleanup item later.

I also would not worry too much about daily refresh performance here. Since these identities are already Inactive (long-term), SailPoint docs on Identity States say they are skipped from scheduled processing, Attribute Sync, and the daily SYNCHRONIZE_IDENTITIES job. So I don’t think keeping them will add much to the daily refresh load.

The main thing I would double-check is the rehire flow. I would make sure the correlation key is stable and unique, so if the user comes back, it links back to the same identity instead of creating a duplicate.

Because your inactive count is large, I would still test this in lower env first. But I personally would not avoid checkDeletedDisabled=true just because of refresh performance concerns.