How to stop duplicate AD accounts created on terminated lifecycle state

[salam1 (Shajedul Alam)]

Hello,

We are currently facing some big challenges with Sailpoint creating duplicate AD accounts (on premise active directory) upon user’s termination in workday.

Here is our setup in sailpoint:

1. Birthright role for all active employees. Role assignment criteria: lifecycle state equals active. This creates the active directory account
2. Default Common access roles for specific departments. Role assignment criteria: Lifecycle state equals active and department = cc1100 and account attribute for active directory DN contains OU. This adds ad groups to users group membership if ad account exists
3. Identity profile → provisioning -->terminated state → disable active directory account

Workday worker status gets updated at midnight user’s local time. Due to this struggle, when IT manually disables an ad account, source aggregation is run, sailpoint sees that there is no active account and recreates a duplicate account since the user is still part of the role with lifecycle state = active. This is happening for all terminations currently.Also, Workday does not provide real time updates on account status

Note: We currently do not have any provisioning rules implemented.The IT team does a few more steps such as moving the user account to disabled ou, reset the password, remove phone numbers and export list of users which isn’t possible via sailpoint out of box functionality. I understand that provisioning rules has to be bought and implemented. But ideally I would like to accomplish this without the need of complex rules.

We only bring in active accounts from active directory source. However, if we were to bring inactive accounts, what would the criteria look like? Adding account attribute = account status = false will stop future accounts from being created.

What are the solutions implemented to prevent duplicate ad accounts from being created? I would love to hear feedback.

[ashutosh08 (Ashutosh Singh)]

Hi @salam1,

Are you delete the account during disablement, or you are just disabling it and just because your filter does not allow inactive user it is linked to the user account?

Thanks

[jsosa (Julian Sosa)]

@salam1

attribute = account status = false will stop future accounts from being c

Hi @salam1

As I can see, as you are filtering aggregation only to active accounts, inactive accounts will not come in next aggregations, so for AD connector it will assume that account was deleter. So behaviour you are reporting is expected, as account will be throwed away from the identity, and when role is refreshed, it will provisiong the account.

Retrieving all accounts is configured simply by a LDAP filter like (objectClass=User). Another thing you can do, is disabling account deletion. So when an admin disables an AD account and an aggregation is performed, account will remain with identity, and role will not try to create another one.

I think that filtering all accounts is the better choice, because it will bring all accounts with enabled and disabled statuses. Second choice will cause to have a AD active account on ISC, and disabled on AD (and, if you have status sincronized, it can lead to a reactivation).

[salam1 (Shajedul Alam)]

I ended up pulling all inactive AD accounts into sailpoint and then added a criteria in birthright access role, acccount attribute = user account status = does not equal = 514

That resolved the issue so even if IT manually disables the account, sailpoint birthright role would ignore it and hence no duplications upon terminations.