We are facing an issue with the Leaver and Housekeep jobs in SailPoint, which disable AD accounts Move Account to disabled OU and remove all assigned roles for users.
The process works smoothly when a user has only one AD account linked. However, if a user has two AD accounts linked, SailPoint opens the Account Selection form, which prevents the process from completing and results in many incomplete forms.
I understand that an accountSelector rule can be attached to roles, but in our case, we have thousands of roles and hundreds of Birthrights, so setting accountSelector to true for all roles is impractical and very time-consuming.
While it makes sense that SailPoint opens the Account Selection form when adding a request, I’m confused why the form appears during role removal. The roleTarget is already defined under roleAssignment, so why does the Account Selection form get triggered in this scenario?
Is there any known fix or best practice to handle this situation efficiently?
Hi @dheerajk27 , in order to preventing unnecessary customization , I think you should use Account Selector Rules . Probably write a Utility and update the Bundle object with account selector Rule from that utility.
Thankyou for the response, but Account Selector rule makes sense when we are making add request as sailpoint would not know which account to provision, but while we are removing the role, its already assigned to identity with roleAssignment refering to specific roleTarget containing nativeidentity of specific link, in that case why account selector is required is something i am not able to understand.
Hi @dheerajk27 , i am gonna test this scenario myself , I am also wondering . Because we also have lots of roles where we are referring AD and AD has multiple accounts . We are also using the Account selector rule .
Thankyou for the response, however it turned out that its by design that either raise add or remove role request if multiple link is found sailpoint would open Account Selection Form, i have already opened an idea in idea portal https://ideas.sailpoint.com/ideas/IIQ-I-1511 so that they can have it under there radar as its not logical to select a link when a role is already assigned.
There is another option which i received from support for handling in the leaver workflow via beforeProvisioning rule to detect if the request type is remove and the target app is AD and if multiple AD accounts exists, loop through them and attach them all to the plan for removal. This is how IIQ will identify which accounts to target.
I will definitely give a try and see how it works out.