Hi, We are having issue with duplicate account creation in AD. Our provisioning process is like when an user gets terminated in the first phase the account will get disable and stay in standard OU without any access removal and in ‘Phase 2’ account will move into disable OU and SailPoint is removi…

where the account is in disable state more than 30 days sailpoint is moving them into disable ou after that workflow is triggering for group removal for that account

We have mapped parent ou in the source configuration which includes disable ou as well

Thank You for getting back to me Faizullah If the duplicate AD account is being created it suggests that IDN is trying to apply AD access somewhere within the system, otherwise IDN wouldn’t create the second account. Have you checked if any access is being applied on the lifecycle state rather tha…

@Mccarney I have found the issue and yes there is a access profile which is a birthright group and we have set the criteria in ROLE but not in ACP not sure why sailpoint is adding that ACP in user account even though we didn’t set the criteria in ACP.

Access Profiles can also be applied via Lifecycle State as well as Roles. The Birthright Access Profile could well be being applied by the Lifecycle State. Admin > Identity Management > Identity Profiles > “Your Identity Profile” > Provisioning > “Whatever lifecycle state the user is in” Check Un…

There is no ACP in provisioning tab of our lifecycle state policy.

Thank You, so at present the birthright access profile is displayed on the Identity but not the birthright role that holds the access profile?

Yes that’s Correct! No role in identity only access profile

Interesting, do you use Workflows?

Yes, but we are not provisioning that access profile via workflows.

Duplicate accounts creation in AD via sailpoint

Identity Security Cloud (ISC) ISC Discussion and Questions

ts_fpatterson (Fred Patterson) August 20, 2024, 10:52pm 21

If you are using the services standard rule / before provisioning rule, you could disable account creations when the lifecycle state shouldn’t be creating accounts.

Services Standard Before Provisioning Rule - Identity Security Cloud (ISC) / ISC Discussion and Questions - SailPoint Developer Community

Topic		Replies	Views
How to stop duplicate AD accounts created on terminated lifecycle state ISC Discussion and Questions rules , identity-security-cloud , provisioning	3	402	June 18, 2024
ISC insist on creating AD account when identity already has ISC Discussion and Questions identity-security-cloud , provisioning , connectors	10	256	May 29, 2025
AD Create Account - sAMAccountName not unique ISC Discussion and Questions identity-security-cloud , provisioning	12	404	June 15, 2025
Sticky entitlement problem. The Sailpoint ISC keep trying to create account in AD even if the Account exists ISC Discussion and Questions identity-security-cloud	27	268	June 5, 2026
Identities not Correlating before Creating Accounts ISC Discussion and Questions aggregation , identity-security-cloud , provisioning , correlation	4	165	November 17, 2025

Duplicate accounts creation in AD via sailpoint

Related topics