IDN - Update Policy for Active Directory

[GOKUL_ANANTH_M]

Hi Bhuvnesh,

Once take a look at the link provided. Best Practices: Active Directory Account Moves - Compass and also https://community.sailpoint.com/t5/IdentityNow-Forum/IdentityNow-Mock-Project-Services-Standard-BeforeProvisioning/td-p/216158

Now, Use Before Provisioning Rule instead of Update Provisioning Rule. This is because, the whole update policy will be called when there is an update in any of the attributes. So, best practice would be to use Before Provisioning rule.

@bhuvi_kpmg

what would be the trigger for this update policy & how it’s different from Attribute sync

The answer for this is the “attribute sync”. If you have enabled attribute sync for the “OU-City” the update provisioning policy will be triggered. Also, you cannot change the CN and DN value directly by using Attribute sync. As the AD knows only if AC_NewName is called it will be an update event for CN and if AC_NewParent means for DN. This can be done via Attribute Sync or else by Before Provisioning Rule.

Take a look at below two links too,

AC_NewName being updated many times

We have AC_NewName in the Update profile as “CN=$sAMAccountName” because a user’s sAMAccountName may change based on their type and we want those changes to be reflected in Active Directory. The changes are going through as expected but we are seeing a Modify request being sent each day from attribute sync even when the value has not changed. { "name": "Account", "description": null, "usageType": "UPDATE", "fields": [ { "name": "AC_NewName", "transform": {…

AD account moves for Disabled Accounts

I’m working on a requirement where we need to move accounts with terminated LCS state to a disabled OU in Active Directory. I created the following transform to move the users to the disabled OU. I’m using the identityAttribute cloudLifecycleState in the transform for the calculation. I used this transform in the accounts create profile for my Active Directory source. The issue i’m having is that the transform is not moving the terminated users to the disabled ou. Below is the transform, has any…

@bhuvi_kpmg

Do I need to include all the attributes which are in “Create Profile”

Only the needy attributes from create profile is enough for Update policy.

Thanks!!