Disable and Move AD account Based on LCS

tejadidm · March 14, 2026, 12:36am

Hi,

We need to implement a change regarding Active Directory (AD) accounts for users on leave of absence and those who are inactive. Specifically, when an LCS user is marked as leave of absence, we should disable their AD account. Additionally, for inactive LCS users, we want their accounts to be disabled and moved to a designated Disabled OU.

Currently, we have Disable provisioning policies in place, but we need to adjust these settings to address our requirements effectively.

Any thoughts or suggestions on how to proceed with this?

{
"name": "Disable Account",

"description": disable account,

"usageType": "DISABLE",

"fields": \[

  {

    "name": "AC_NewParent",

    "transform": {

      "attributes": {

        "value": "OU=DisabledUsers,DC=XXX,DC=XXX"

      },

      "type": "static"

    },

    "attributes": {

      "cloudRequired": "true"

    },

    "isRequired": false,

    "type": "string",

    "isMultiValued": false

  },

  {

    "name": "msExchHideFromAddressLists",

    "transform": {

      "attributes": {

        "value": "true"

      },

      "type": "static"

    },

    "attributes": {},

    "isRequired": false,

    "type": "boolean",

    "isMultiValued": false

  }

\]
}

Thanks!

Pankaj_IAM_SailPoint · March 14, 2026, 5:02am

Hello @tejadidm ,

Welcome to the SailPoint Developer Community !!

Based on my understanding you want to implement below :

a) For Leave of Absence (LOA) → Disable AD account only
b)For Inactive user → Disable AD account + Move to Disabled OU

Try to use below code:

{
”name”: “Disable Account”,
“description”: “disable AD account for LOA and Inactive users,
“usageType”: “DISABLE”,
“fields”: [
{
“name”: “AC_NewParent”,
“transform”: {
“type”: “conditional”,
“attributes”:  {
“expression”: “$identity.employmentStatus == ‘Inactive’”,
“positiveCondition”: “OU=DisabledUsers,DC=XXX,DC=XXX”,
“negativeCondition”: null
}
},
“type”: “string”,
“isMultiValued”: false
},
{
“name”: “msExchHideFromAddressLists”,
“transform”:  {
“type”: “static”,
“attributes”:  {
“value”: “true”
}
},
“type”: “boolean”
}
]
}

msingh900 · March 14, 2026, 5:56am

For LOA, You can directly configure in Lifecycle Mangement section of Identity profile.

For Inactive user usecase, try adding the provisioning policy explained in the previous post by @Pankaj_IAM_SailPoint

ssowmya567 · March 14, 2026, 6:01am

To disable AD accounts, you can manage through life cycle state. Once the life cycle state transitions to Disabled, the disable operation will be triggered and the provisioning policy can move the account to the Disabled OU.

tejadidm · March 14, 2026, 10:54pm

Hi @Pankaj_IAM_SailPoint

Thank you, I tried this and no action when account is inactive or leaveofabsence.

{
“name”: “Disable Account”,
“description”: “disable AD account for LOA and Inactive users”,
“usageType”: “DISABLE”,
“fields”: [
{
“name”: “AC_NewParent”,
“transform”: {
“type”: “conditional”,
“attributes”: {
“expression”: “$identity.cloudLifecycleState == ‘inactive’”,
“positiveCondition”: “OU=DisabledUsers,DC=Test,DC=com”,
“negativeCondition”: null
}
},
“attributes”: {},
“isRequired”: false,
“type”: “string”,
“isMultiValued”: false
},
{
“name”: “msExchHideFromAddressLists”,
“transform”: {
“type”: “static”,
“attributes”: {
“value”: true
}
},
“attributes”: {},
“isRequired”: false,
“type”: “boolean”,
“isMultiValued”: false
}
]
}

iamnithesh · March 15, 2026, 1:01pm

As you need to carry out 2 different operations when account is Disabled, in my opinion SSI Rule is your best choice.

Check this post for more details on rule

IAMpdu · March 16, 2026, 4:31pm

Hello @tejadidm , Can you try below code -

{
  "name": "Disable Account",
  "description": "disable AD account for LOA and Inactive users",
  "usageType": "DISABLE",
  "fields": [
    {
      "name": "AC_NewParent",
      "transform": {
        "type": "conditional",
        "attributes": {
          "expression": "$employmentStatus  eq InActive",
          "positiveCondition": "$disabledOU",
          "negativeCondition": "null",
          "$employmentStatus": {
            "attributes": {
              "name": "email"
            },
            "type": "identityAttribute",
            "name": "Identity Attribute Transform"
          },
          "disabledOU": {
            "attributes": {
              "value": "OU=DisabledUsers,DC=XXX,DC=XXX"
            },
            "type": "static"
          }
        }
      },
      "type": "string",
      "isMultiValued": false
    },
    {
      "name": "msExchHideFromAddressLists",
      "transform": {
        "type": "static",
        "attributes": {
          "value": "true"
        }
      },
      "type": "boolean"
    }
  ]
}

tejadidm · March 16, 2026, 7:10pm

Hi @IAMpdu

Thank you, no action when cloudlifecyclestate change to leaveofabsence or inactive.

Tursun · March 17, 2026, 2:01am

Hi @tejadidm! Can you try bellow approach please. Thanks

Create Conditional transform

{
    "name": "disableOU-test-logic",
    "type": "conditional",
    "attributes": { 
        "expression": "$lifecycleState eq inactive", 
        "positiveCondition": "$disabledOU",
        "negativeCondition": "",
        "lifecycleState": { 
            "type": "identityAttribute", 
            "attributes": { 
                "name": "cloudLifecycleState"
             }
         },
         "disabledOU": { 
             "type": "static",
             "attributes": {
                 "value": "OU=DisabledUsers,OU=People,DC=XXX,DC=XXX"
             }
         }
     }
}

Please Use reference transform in the Disable policy

{
     "name": "DisableOU",
     "description": null,
     "usageType": "DISABLE",
     "fields": [ 
        { 
           "name": "AC_NewParent",
           "transform": { 
               "attributes": { 
                  "id": "disableOU-test-logic" 
               },
               "type": "reference",
               "name": "DisableOU Ref Transform"
           },
           "attributes": {},
           "isRequired": false,
           "type": "string",
           "isMultiValued": false
        }
     ]
}

tejadidm · March 17, 2026, 6:41pm

Hi @Tursun Should I map the transform to AD DistinguishedName attribute?

Tursun · March 17, 2026, 8:26pm

Hi, no need to map it. Just use reference transform in the Disable policy.

PhilRawlings1 · March 18, 2026, 9:29am

Alternatively you can create two Identity attributes for mapping where the OU should be and where it is, and use this disparity to force the move:
See my post here:
Substring Transform within Workflow - Identity Security Cloud (ISC) / ISC Discussion and Questions - SailPoint Developer Community

tejadidm · March 18, 2026, 12:40pm

Hi @Tursun I am not seeing account disable or account disable and move on both scenarios.

Thank you

j_place · March 18, 2026, 2:47pm

Hi @tejadidm Silly question, but have you associated disable account with the lifecycle states?

tejadidm · March 18, 2026, 3:48pm

Hi @j_place Yes, source is already in both lifecycle states.

PhilRawlings1 · March 19, 2026, 11:46am

Hi,
Just ticking all boxes, you have added the source to both LCS in the identity profile to disable the source?

tejadidm · March 19, 2026, 2:16pm

Hi @PhilRawlings1

Yes, i added AD source in both leaveofabsence and inactive identity profile, while testing I noticed when identity status change to leaveofabsence I see AD account is disabling, but when status change to inactive I am not seeing account is disabling.

BBR1 · March 19, 2026, 2:58pm

I had a similar senario, where in the disable provisioning policy form we checked ”cloudlifecyclestate” value.

1.In case of LOA what is the “cloudlifecyclestate” state value. Depending on that value, just disable the account.

2.For Disabled accounts, cloudlifecyclestate is inactive, check it and AC_newparent vallue as well and move the accounts to disabled OU.

Tursun · March 19, 2026, 3:50pm

Do you have disable policy?

Tursun · March 19, 2026, 3:52pm

Same here, I had a similar scenario as well and I proposed this earlier in the chat.

Topic		Replies	Views
AD provisioning Policy not Moving to Disabled OU ISC Discussion and Questions rules , identity-security-cloud	13	205	September 14, 2025
Account not disabled after user moved in AD ISC Discussion and Questions identity-security-cloud	15	391	May 3, 2025
AD OU movement for Disable and Re-hire ISC Discussion and Questions rules , identity-security-cloud	16	225	April 14, 2026
IdentityNow Inactive Lifecycle State Not Disable AD ISC Discussion and Questions identity-security-cloud , identityiq	25	337	September 22, 2025
Move AD Account that's already disabled to different OU ISC Discussion and Questions	7	1589	July 19, 2023

Disable and Move AD account Based on LCS

Related topics