Hi Team, Did anyone fixed the below error in SailPoint ISC. We are getting below error only in stage while AD disable operation. ["Error(s) reported back from the IQService - Error occurred while setting group membership CN\u003dDomain Users,CN\u003dUsers,DC\u003dSJX2,DC\u003dCOM. Access is denie…

Even though from error, it seems that its permission issue but actually, it’s due to the fact that you are trying to add Domain User group to the user which technically is not needed. The Domain Users is default primary group and its derived from the primaryGroupIDAttribute not from the member attri…

@bsayya01 You can refer to this post. It has a similar use case to yours. IQService Error - Access Denied (0x80070005) While Modifying AD Group Membership - IdentityIQ (IIQ) / IIQ Discussion and Questions - SailPoint Developer Community IN my client environment, we are assigning Domain Users to t…

Domain user is not configured as requestable product or assigned to any of the birth right roles. Could it be issue with provision policies?

also In IQ server log says only below groups are getting removed. <AttributeRequest op="Remove" name="memberOf"> <Value> <List> <String>CN=ITS-APP-WORKVIVO-USERS,OU=Security,OU=IDM,OU=Groups,DC=ABC,DC=COM</String> <String>CN=confluence-users,OU=Security,OU=IDM,OU=Groups,DC…

Hello Baji, based on the IQ log you shared, I don’t think this is coming from requestable access or birthright roles. The plan is removing only these 3 groups: ITS-APP-WORKVIVO-USERS confluence-users jira-users But the error is pointing to Domain Users, which is not in that AttributeRequest. I t…

[image] harish Punna: So my first test would be to temporarily disable/comment the Stage after script and retry. If the disable works, then the script or custom cleanup logic is touching Domain Users. Exclude Domain Users / primary group from the remove-group logic, and the disable should go thr…

This RequestAsString log tells us that the memberOf Set with Domain Users is already in the request when it reaches IQService. So this is coming from the ISC cloud side, not from the IQService native scripts. I’d check the cloud-side plan generation first. The stronger areas to look at are the AD so…

Looke like you are using native rule, check whether there is enough permission for the log on user for the IQ service

[image] Baji Sayyad: gured as requestabl @bsayya01 try using a different group for birth right provisioning. As domain users is added by birth

Disable operation failing in Stage AD

Identity Security Cloud (ISC) ISC Discussion and Questions

j_place (Jeremy Place) July 2, 2026, 4:45pm 7

Hi @bsayya01 Do you have remove all access set on your lifecycle state? If so, there are a number of posts in the forum on the subject. For example, Getting error while removing all AD groups while user offbaording - #5 by Krishna_55

Topic		Replies	Views
Provisioning issue for AD ISC Discussion and Questions identity-security-cloud	3	561	October 24, 2024
How to Filter Out Domain Users Entitlements on Remove All Access ISC Discussion and Questions rules , identity-security-cloud , lifecycle-management	6	310	February 17, 2026
Active directory unable to remove ad groups during disable operation ISC Discussion and Questions identity-security-cloud , provisioning , connectors , entitlements , active-directory	12	336	September 12, 2025
Getting AD connector Error while resetting the password through Before provisioning rule when accounts is getting disabled on Termination ISC Discussion and Questions rules , identity-security-cloud , provisioning , connectors	5	119	March 10, 2026
Getting error while removing all AD groups while user offbaording ISC Discussion and Questions identity-security-cloud	4	403	May 7, 2025

Disable operation failing in Stage AD

Related topics