How we can store object ids after 30 days of AD account deletion from termination date

Hey Rakesh!

Instead of trying to store the deleted ObjectId on an identity attribute, you could look at utilizing a UniqueID database. We implemented this for tracking deleted accounts and it works well for us as it also helps prevent account names (like samAccountName, mail, upn, etc.) from being reused when accounts are being created. It is basically a delimited file source ISC writes to anytime it creates an account in the specified source(s). You can write attributes like identityId and objectId to these “accounts” so you can relate identities to Entra accounts and it would work well if users end up having multiple accounts. It also would retain the mapping after an identity is deleted so you can reference it in the future if needed. Here is a great video and workflow json on how you could implement this solution: Leveraging workflows for a fully native unique ID database - Content / Video Library - SailPoint Developer Community

Let me know if this helps!

  • Zach