Due to change in role criteria, AD accounts are created for terminated users, how disable of AD accounts will be achieved?

Identity Security Cloud (ISC) ISC Discussion and Questions
1

Due to change in role criteria, AD accounts are created for terminated users. Now criteria is back, entitlements are removed, but AD accounts did not disabled though AD source is added under LCS of terminated user to disable account.

let us know how disable of AD accounts will be achieved?

2

That’s unfortunate, only if users are moving into that LCS then only Accounts will be disabled. Since those users are already in Terminated LCS, nothing will apply on their accounts.

Option 1: Move those users LCS to some other and get back to Terminated
Option 2: Get all those users and disabled them manually using APIs or UI

1 Like
3

any chance doing in bulk we have 300 such accounts please

4

We can build script to bulk disable all those accounts, we need to supply the account ID to the API, so we need to get all the account IDs we need to disable.

It’s a multiple step process, I have done it earlier, let me check it for you.

5

sure let me know that can be helpful.

6
  1. Get All the users impacted, their long IDs
  2. Use Accounts API to get account for each identity by using filters with IdentityIQ and SourceID
  3. Get Account ID
  4. Make use of Disable Account API call and pass the account ID
7

This may also be solved using workflow. Like Krishna mentioned you can do the below steps in workflow

  1. Run a search for identities with lifecyclestate as inactive and AD account active
  2. Run a loop and use Manage Accounts - Disable Account option

Before the 2nd step you may have to figure out how to get the account id. So, you might end up using HTTP Request actions in your workflow.