Capture AD Disabled accounts outside sailpoint

SailPoint Human Fabric (SHF) SHF Discussion and Questions
1

Hello All,

We are looking to capture the list/report of the accounts which are disabled outside of SailPoint ISC. However, In our environment we do not have Native change detection enabled.

Is there any way we can get the report.

Thanks,

Maninder K

2

Have you tried a search?

@accounts(source.name:"Active Directory" AND disabled:true)

Call the search API from “outside of SailPoint ISC” and parse through the results. If you provide more details, we could give more direct insight. Here’s the API request:

POST {{apiURL}}/search/v1

{
    "indices": [
        "identities"
    ],
    "query": {
        "query": "@accounts(source.name:\"Active Directory\" AND disabled:true)"
    }
}
3

One additional detail - that query will get you identities with disabled accounts. If you want all disabled accounts, even uncorrelated, then you will want to iterate over the /accounts/v1 endpoint instead of using search.

4

Thanks Matt, this query appears to give the accounts that are disabled by Sailpoint.

I am primarily looking for the accounts which got disabled outside of Sailpoint i.e. via any other automation or from the AD tool.

could you provide any insights.

Thank you,

Maninder Kaur

5

@maninderkaur_co-op

You can write a powershell script to pull the AD disable records and using the task scheduler you can run it on schedule basis that is one way you can achieve this.

6

You can enable native change detection. Capture events where the userAccountControl attribute is changed. Then your workflow will need to evaluate the new value of userAccountControl to see whether it indicates a disabled account.

7

Hi @maninderkaur_co-op,

Not exactly. This query will return all identities that have a disabled AD account.

For your use case, the recommended approach would be to use NCD, as it can be configured to target the specific scenario you’re looking for more effectively.

8

Moving forward from here, you can get Sailpoint to set a field when it disables/enablea account. You can then use that absence to determine what is being disabled outside of IDN.
We use:

{
  "name": "comment",
  "transform": {
    "attributes": {
      "values": [
        {
          "attributes": {
            "value": "Disabled by IDN: "
          },
          "type": "static"
        },
        {
          "attributes": {
            "dateOffset": "0",
            "input": {
              "type": "trim"
            },
            "inputFormat": "M/d/yyyy",
            "name": "Cloud Services Deployment Utility",
            "operation": "getDate",
            "outputFormat": "yyyy-MM-dd",
            "referenceDate": "now"
          },
          "type": "rule"
        }
      ]
    },
    "type": "concat"
  },
  "attributes": {},
  "isRequired": false,
  "type": "string",
  "isMultiValued": false
}
9

HI @maninderkaur_co-op

This ain’t gonna be straight forward but i can think of a longer route:

  1. Download Active Directory accounts export.
  2. Get all the AD disabled accounts.
  3. For all those AD accounts you perform a search query again. Something like this:
    (attributes.identificationNumber:“A” OR attributes.identificationNumber:“B”…) AND “disable account passed” AND “Active Directory”

So this will basically give you a list of events for which sailpoint disabled the Active Directory accounts.

You can do a excel vlookup to filter these accounts from your AD accounts list. Remaining ones are the onces for which sailpoint does not have a record of they being disabled.