How to stop provisioning for inactive identities

[vikramsah]

Hi All,

The disabled accounts on Azure AD in our tenant gets automatically deleted after a certain period. Once that happens, Identity now still keeps on attempting provisioning events (due to identity refresh) on these accounts. As the account is deleted, it tries to recreate the account.

Is there a way to stop this? As of now not populating the create account policy is one way i can think of, but that still causes it to keep on attempting and generate provisioning errors. Is there a concrete way to make an account/identity invisible to provisioning activities or identity refreshes?

[Sachin_Rajathadri]

Hi @vikramsah,

Could you please include more details regarding your Azure AD connector?
For example, are you using Azure AD for just reading the account details (No provisioning at all)? are you using the old Azure AD connector or the new Entra connector? provisioning details like Role based or Access profile based provisioning? etc.
This would help us provide solution to your issue.
Thanks!

[Sivakrishna1993 (Sivakrishna Kommineni)]

Hi
If you are using any RBAC approach to create account in Azure, then you need to add extra criteria lifecycle state in your role assignment criteria to dissatisfy the role.

Thanks,
Siva.K

[phil_awlings (Phil Rawlings)]

Put a tick in this box, and then Sailpoint won’t remove the account from the Cube, thus stopping the account creation process from starting again

[mohammedfavazhrb (Mohammed Favaz S A)]

Hi @vikramsah ,

Could you please describe how the access is getting assigned to the account. is it via a Role addition using criteria? or is it via an already requested access via Request center?

if it’s via criteria, then you can add an extra role criteria to check if account exists,
for eg., like userprincipal name contains @ . In this case the role will be removed if the account doesn’t exist.

Thanks

[vikramsah]

I am using the old Azure AD connector. There are some provisioning being done too. Some entitlements are role based. But the others which are not role based are causing issues like entitlement stickiness even when the actual account has been deleted on the source.

[vikramsah]

The role based accesses are not a concern. It is the free entitlements which are provisioned by the ID center and then there are those which are just there in azure.

[mohammedfavazhrb (Mohammed Favaz S A)]

Ok. Then removing those sticky entitlements is the only other option i think. or else it will try to add those entitlements which in turn will create the Create account event. Even if you tweak the create account provisioning policy, everyday create account event will be retried and will be failed.

if you need any help with sticky entitlements removal you can refer this discussion. it can be achieved via workflow.

Sticky Roles Removal for inactive accounts

Hi team, We are facing a challenge related to the nature of Roles being “sticky assignments” to the identity. We are currently using Roles for Access Requests. The decision to use Roles was made since we are using the “Service Catalog” integration and we wanted to avoid having two different tabs for both Roles and Access Profiles. Another team runs a dormancy process that disables accounts inactive for 90 days and deletes them after an additional 90 days. These accounts are not limited to ina…

AD Entitlement Provisioning to Inactive Identities

Hello All - I’ve noticed that IDN will continue to add AD entitlements that were requested via request center (sticky entitlements) to inactive identities if the entitlement is removed from the source account. What’s concerning is that if the AD account is deleted, IDN will recreated the AD user object in an active state and add the entitlement, despite an inactive LCS. I hope this is not the expected behavior?? How do we get IDN to release the sticky entitlements to prevent this?