# Duplicate accounts creation in AD via sailpoint **URL:** \ **Category:** SHF Discussion and Questions\ **Tags:** provisioning, sailpoint-identity-security\ **Created:** [August 19, 2024, 9:49am UTC](https://developer.sailpoint.com/discuss/t/duplicate-accounts-creation-in-ad-via-sailpoint/77137 "2024-08-19T09:49:30Z")\ **Posts on this page:** 9\ **Page:** 2
**Author:** ![ts\_fpatterson](https://sea1.discourse-cdn.com/sailpoint/discuss/user_avatar/developer.sailpoint.com/ts_fpatterson/32/26704_2.png) [@ts\_fpatterson](https://developer.sailpoint.com/discuss/u/ts_fpatterson)\ **Post date:** [August 20, 2024, 10:52pm UTC](https://developer.sailpoint.com/discuss/t/duplicate-accounts-creation-in-ad-via-sailpoint/77137/21 "2024-08-20T22:52:29Z")
If you are using the services standard rule / before provisioning rule, you could disable account creations when the lifecycle state shouldn’t be creating accounts. [Services Standard Before Provisioning Rule - Identity Security Cloud (ISC) / ISC Discussion and Questions - SailPoint Developer Community](https://developer.sailpoint.com/discuss/t/services-standard-before-provisioning-rule/11228) ---
**Author:** ![FaizullahShaik](https://avatars.discourse-cdn.com/v4/letter/f/9d8465/32.png) [@FaizullahShaik](https://developer.sailpoint.com/discuss/u/FaizullahShaik)\ **Post date:** [August 21, 2024, 2:26am UTC](https://developer.sailpoint.com/discuss/t/duplicate-accounts-creation-in-ad-via-sailpoint/77137/22 "2024-08-21T02:26:57Z")
when life cycle change from phase1 to phase2 we are moving the account into disable OU after that all access/groups associated within the account are getting removed via workflow. After that there are some groups are getting added in the profile few are related with script which has nothing to do with lifecycle state but there is one more group (Access Profile) which is getting assigned even though there is no criteria set in it. is it possible that after moving the account into disable OU and workflow is removing all groups including birthright so sailpoint is not understanding here? ---
**Author:** ![agutschow](https://sea1.discourse-cdn.com/sailpoint/discuss/user_avatar/developer.sailpoint.com/agutschow/32/8543_2.png) [@agutschow](https://developer.sailpoint.com/discuss/u/agutschow)\ **Post date:** [August 21, 2024, 10:22pm UTC](https://developer.sailpoint.com/discuss/t/duplicate-accounts-creation-in-ad-via-sailpoint/77137/23 "2024-08-21T22:22:56Z")
So let me try to summarize: 1. New user gets created. Role with membership criteria and access profile is getting added to create AD account. LSC is Phase 1 2. User is terminated. LCS changed to Phase 2. User is getting moved to disabled OU. 3. Role is removed because user no longer meets criteria. 4. AD groups are removed through workflow. 5. New Access Profile is getting assigned which is triggering a new account to be created. The new Access Profile is not part an assigned role and is not part of any LCS. Is this correct? Is it possible that your script to add groups for Phase 2 is adding the same group in the Access Profile? Does this Access Profile only have one entitlement? ---
**Author:** ![FaizullahShaik](https://avatars.discourse-cdn.com/v4/letter/f/9d8465/32.png) [@FaizullahShaik](https://developer.sailpoint.com/discuss/u/FaizullahShaik)\ **Post date:** [August 22, 2024, 3:20am UTC](https://developer.sailpoint.com/discuss/t/duplicate-accounts-creation-in-ad-via-sailpoint/77137/24 "2024-08-22T03:20:34Z")
The new Access Profile is not part an assigned role and is not part of any LCS. Is this correct? _no, the access profile is part of birthright role but role is not getting assigned to account but access profile do getting assigned even though there is no criteria_ Is it possible that your script to add groups for Phase 2 is adding the same group in the Access Profile? _those group is not getting added as per LCS and they are not linked with any access profiles, its just a script that if any user completed the course SailPoint received that file in IQ server, read it and assigned the groups_ Does this Access Profile only have one entitlement? yes ---
**Author:** ![RAKGDS](https://sea1.discourse-cdn.com/sailpoint/discuss/user_avatar/developer.sailpoint.com/rakgds/32/2795_2.png) [@RAKGDS](https://developer.sailpoint.com/discuss/u/RAKGDS)\ **Post date:** [August 22, 2024, 4:05am UTC](https://developer.sailpoint.com/discuss/t/duplicate-accounts-creation-in-ad-via-sailpoint/77137/25 "2024-08-22T04:05:42Z")
Hi Faizullah, I think you may be seeing issue of Sticky Entitlement. Can you let us know if you have access request enabled and are requesting entitlement for the user ? Thanks Rakesh ---
**Author:** ![FaizullahShaik](https://avatars.discourse-cdn.com/v4/letter/f/9d8465/32.png) [@FaizullahShaik](https://developer.sailpoint.com/discuss/u/FaizullahShaik)\ **Post date:** [August 22, 2024, 5:12am UTC](https://developer.sailpoint.com/discuss/t/duplicate-accounts-creation-in-ad-via-sailpoint/77137/26 "2024-08-22T05:12:04Z")
yes access request is in enabled state for the access profile but not for entitlement. ---
**Author:** ![agutschow](https://sea1.discourse-cdn.com/sailpoint/discuss/user_avatar/developer.sailpoint.com/agutschow/32/8543_2.png) [@agutschow](https://developer.sailpoint.com/discuss/u/agutschow)\ **Post date:** [August 22, 2024, 12:58pm UTC](https://developer.sailpoint.com/discuss/t/duplicate-accounts-creation-in-ad-via-sailpoint/77137/27 "2024-08-22T12:58:42Z")
I am thinking on the same lines as Rakesh. One of two things may be happening: 1. The user has the group assignment in AD or is getting it from some external process - when this entitlement is aggregated in AD, if the Access Profile only has this one entitlement, the Access Profile will be “assigned” as the user already has the entitlements that are included. or 1. This entitlement was directly assigned by ISC at some point. If it is not requested to be removed it will persist and even be reassigned to the user if it is removed. If it is getting reassigned, after aggregation, the access profile will also be linked as the user meets the has the entitlement(s) included in the access profile. ---
**Author:** ![FaizullahShaik](https://avatars.discourse-cdn.com/v4/letter/f/9d8465/32.png) [@FaizullahShaik](https://developer.sailpoint.com/discuss/u/FaizullahShaik)\ **Post date:** [August 23, 2024, 5:12am UTC](https://developer.sailpoint.com/discuss/t/duplicate-accounts-creation-in-ad-via-sailpoint/77137/28 "2024-08-23T05:12:33Z")
those are getting assigned via script and but somewho sailpoint is not recognizing the account which is in disable OU because of that new account is getting created. ---
**Author:** ![system](https://global.discourse-cdn.com/sailpoint/original/2X/f/f2136700ed5e3703e0b85e02f6be799dacca7735.png) [@system](https://developer.sailpoint.com/discuss/u/system)\ **Post date:** [October 22, 2024, 5:12am UTC](https://developer.sailpoint.com/discuss/t/duplicate-accounts-creation-in-ad-via-sailpoint/77137/29 "2024-10-22T05:12:48Z")
This topic was automatically closed 60 days after the last reply. New replies are no longer allowed. [Previous page](https://developer.sailpoint.com/discuss/t/duplicate-accounts-creation-in-ad-via-sailpoint/77137.md?page=1)