With the recent release of the Delete Accounts (Human and Machine) with Configurable Approvals capability (announcement here), I’ve been testing the new approval settings for machine account deletion across our Entra sources.
What I’m seeing:
On our Microsoft Entra ID (VA-based) source, the Machine Accounts → Approval Settings section is visible and configurable as expected.
On our Microsoft Entra (SaaS) source, the Machine Accounts → Approval Settings section does not appear at all.
Per the announcement, the approval settings for machine account deletion are available on sources that support the DELETE operation. Since both the VA-based and SaaS-based Entra connectors document delete support, I would expect the approval settings to appear on both.
Questions:
Is the machine account deletion approval feature currently limited to VA-based (direct) connectors only, even if the SaaS connector supports the std:account:delete command?
@ajmerasunny1 When you click on the Actions menu for an account from Microsoft Entra (SaaS) source, do you see the “delete” option?
If “delete” isn’t among the features per source, the Approval Settings won’t be displayed. You can check by calling list-sources | SailPoint Developer Community API and checking if the specific source “delete” string is in the features array.
@NataliaYunusov Interestingly, the DELETE feature was not enabled on our Entra SaaS source by default. After patching the source configuration to add the Delete Account capability, I was able to see the DELETE Account on the Actions — however, the Approval Settings submenu under Machine Accounts still does not appear. So even with DELETE explicitly enabled on the SaaS source, ISC is not surfacing the approval configuration option the way it does on the VA-based connector.
Hi,
I hope you’re doing well! I wanted to touch base about the criteria we need to meet in order to display the Approval Settings menu:
The UIINT2394_ACCOUNT_DELETION_VIA_UI_AND_WORKFLOW feature flag needs to be enabled.
The source connection type should be something other than ‘file’ (FLAT_FILE).
The source features need to include the DELETE action.
Provisioning needs to be enabled.
Since you can see the Delete action on the Accounts grid, we can set aside the first three points. Also, since the source details page doesn’t show the Read-only badge, it looks like Provisioning is enabled as well!
I wasn’t able to find anything in the code that might be preventing the Approval Settings from appearing. Would you be open to jumping on a call to discuss this further?
