New Account Provisioned Email Notifications – Configuration and Documentation Clarification

Identity Security Cloud (ISC) ISC Discussion and Questions
, , , , ,
1

Hi All,

We are currently troubleshooting an issue related to the New Account Provisioned Email Template, which is already configured to notify an identity’s manager.

Reference: New Account Provisioned Email Template - SailPoint Identity Services

We have the following accountCreateNotification configuration defined on one of our sources, where the account manager is notified when a new account is provisioned:

"accountCreateNotification": {
    "notifyAccountManager": true,
    "accountIdAttribute": "distinguishedName",
    "notifyList": null,
    "notifyAccountOwner": false,
    "enabled": true,
    "notifyAccountOwnerAltEmail": false
}

We are trying to determine whether this functionality is still supported, as it does not appear to be working for us.

Additionally, while reviewing the following community article, I noticed that the accountCreateNotification payload uses a slightly different set of parameters:

https://community.sailpoint.com/t5/Identity-Security-Cloud-Wiki/API-to-Notify-Users-When-a-New-Account-is-Provisioned/ta-p/77476#enable

Could someone please clarify the difference between the parameters shown in the community article and those currently returned by the API? Has the configuration changed over time, or are both formats/params still supported? also on steps how to troubleshoot on when above stopped working?

Regards,

2

Can you elaborate on this? What are you observing if it’s not working?

3

@lalithajay - I have used this feature , which trigger email to the user , when account gets provisioned on a source, and its working as expected.

4

Hi @iamnithesh

When accounts get provisioned (new hire), managers are not getting the email anymore.

5

Hello @lalithajay ,

Can you check if you are able to see "“Send email passed” event on the account creation? Is the issue in PROD?

Can you try changing notifyAccountManager to emailAccountManager and see if its working?

6

Thanks @ThejaC

Yes it is in prod

It is exactly my question , because in above post (https://community.sailpoint.com/t5/Identity-Security-Cloud-Wiki/API-to-Notify-Users-When-a-New-Account-is-Provisioned/ta-p/77476#enable) am seeing different set of params (below) to what we configured in PROD, your recommendation also in below, so just curious any change to those config params before we go and change

{
		"enabled":true,
	 	"emailAccountOwner":false,
                "emailAccountOwnerAltEmail":false,
	 	"emailAccountManager":false,
                "accountIdAttribute":"distinguishedName",
	 	"sourceId":"<externalId from Source List>",
	 	"accountNotificationList": [
	 		"user_a@yourdomain.com",
	 		"user_b@yourdomain.com"
	 	]
	 }
7

Hello Lalitha, the parameter difference is because that Compass article uses the old /cc/api/emailTemplate/setAccountCreateNotificationOptions API, which accepts params like emailAccountManager, emailAccountOwner, accountNotificationList. That API is deprecated.

image
image2206×170 32.4 KB

The current supported method is the Update Source (Partial) API, where the config lives under connectorAttributes.accountCreateNotification using notifyAccountManager, notifyAccountOwner, notifyList, etc. Your current field names are correct, so I wouldn’t swap them to emailAccountManager or the other old parameter names.

image
image2420×354 56.5 KB

Since the source configuration looks fine, pick one recent new hire and confirm the account was created through an ISC provisioning action, not discovered through aggregation. Then verify the manager is correctly resolved in ISC and has a valid email address.

I would verify the identity’s manager is properly resolved in ISC and has a valid email. Also check Admin > Global > Email Templates > Settings and confirm it is set to Intended Recipients. If it is set to Test Address, all notifications are redirected there. Check that the New Account Provisioned template subject does not start with no_send or Stop. After that, search the audit events around that provisioning time for Send Email Passed or Send Email Failed to see if ISC even attempted the send.