Mover - Update DN in AD

Identity Security Cloud (ISC) ISC Discussion and Questions
, ,
1

Hello,
My company has been working on a project to get our Contractors into Workday as they use to be created in our authoritative source (ServiceNow). This action has been completed, however when contractors get hired on full time as associates they are generated a duplicate account. This has been the case for the past 9 years.

To solve this, myself an coworkers from the Workday and ServiceNow team have been working on troubleshooting this issue. ServiceNow is out authoritative source, Workday modifies the user type from Contingent to Associate.

In my transform I have the DN listed to adjust the Primary OU based on this user type and I can confirm that when previewing the account in question the Primary OU is correct however the ADOU is still our contractors OU so the account was not moved.

In my create account configuration in AD, we have the generator Create Unique Account ID with the pattern - CN=$(lastname),$(firstname)$(uniqueCounter),$(primaryOu)

I believe my issue here is this attribute calculation is only processed once during account creation but is not triggered again. Please help point me in the right direction to have the distinguishedName change when users switch user types.

2

Hi Jacob,
Take a look at this post where I use the UPDATE function of AD to move the users OU:

1 Like
3

Phil,
I will test this, thank you for sharing your knowledge!

1 Like
4

i wasn’t aware we could use the AC_NewParent to move the user outside of the Services Standard Build Rule, that’s great to see. does this mean we can use it in a Disable profile as well?

5

Here you go…

 {
      "name": "Account",
      "description": null,
      "usageType": "DISABLE",
      "fields": [
          {
              "name": "AC_NewParent",
              "transform": {
                  "attributes": {
                      "value": "OU=Leavers,OU=User Accounts,DC=ad,DC=domain,DC=com"
                  },
                  "type": "static"
              },
              "attributes": {},
              "isRequired": false,
              "type": "string",
              "isMultiValued": false
          },
          {
              "name": "msExchHideFromAddressLists",
              "transform": {
                  "attributes": {
                      "value": true
                  },
                  "type": "static"
              },
              "attributes": {},
              "isRequired": false,
              "type": "boolean",
              "isMultiValued": false
          }
      ]
  }
1 Like