Modification of AD account

[shaileeM (Shailee Mehta)]

Dear All,

We have a use case where one identity can possess two AD accounts on the same AD source. I understand that modification in such cases fail with below error:

Native Identity should not be null or empty

May I understand is there a way to modify just the primary account and do not touch the secondary account.

Any help on this would be appreciated.

Thanks,
Shailee

[ts_fpatterson (Fred Patterson)]

You will want to create multiple AD sources. Be aware of the account types and what access they need in comparison to other accounts on the other source. An example use case might be for privileged accounts where you would want separate entitlements, container placement, etc.

[shaileeM (Shailee Mehta)]

Thank you @ts_fpatterson.

Yes you are right, some of the secondary accounts are indeed part of PAM accesses, some are not.

I was wondering if its possible to instruct IDN with correct nativeIdentity value in BP Rule to achieve this?

I understand that creating multiple AD sources is one of the options.

[sushantkulkarni]

Can you also look into this thread for configuring the access provisioning for multiple accounts?
IdentityNow Multi Account Support - Identity Security Cloud (ISC) / ISC Discussion and Questions - SailPoint Developer Community

You can specify a preference here for access requests. But for other modifications, @ts_fpatterson’s suggestion is what generally is preferred due to its simplicity. But if you explicitly need to do it in a single source, as you already mentioned, a complex before provisioning rule will be required to ensure the right account is selected for provisioning.

I would not prefer this approach as there are some considerations with what happens with ProvisioningResult object in the backend, which will need some manipulation to avoid ISC to trigger an unintended retry of provisioning. It can get tricky with ensuring all corner cases are handled in your code. But if you really had to go for it, consider the rule util APIs to fetch the intended account and reconstructing the account request with the necessary downstream use cases handled.