Hi All,
We are using a web service connector to aggregate inorganic employees. Is there a way to exclude from aggregating the identities with department values equal to “Maintenance” or “Facilities”? If so, where do we configure it and would that also delete the identities that are already aggregated before?
Hello Jasmine. Yes, I would first check whether the source API supports filtering by department. If it does, add the exclusion to the Web Services Account Aggregation Context URL or request body so Maintenance and Facilities records are not returned.
If the API does not support filtering, you can attach an After Operation Rule to the Account Aggregation operation and return a filtered data list excluding those two department values.
For records already aggregated, if Enable Account Deletion is enabled, a full aggregation can remove accounts that are no longer returned. If this is an authoritative source, removing those accounts can also affect the related identities depending on your authoritative-source configuration. If account deletion is disabled, the existing accounts will remain.
Yes, this can typically be handled in the Account Aggregation endpoint by filtering out accounts where the Department value is Maintenance or Facilities, so they are not sent to SailPoint during aggregation.
For accounts that have already been aggregated, if they are no longer returned by the endpoint, you can run aggregation with the Account Delete Threshold set to 100%. SailPoint will then identify those accounts as missing and process them according to the source’s account deletion settings, which may result in their removal from SailPoint.