New Capability: Management of Inactive Identities

[fpdias (Filipe Dias)]

Oh ok, I’ll try it then.

Thank you very much.

[RArroyo (Renee Arroyo)]

This is great news and easy to implement. What does not occur is the auto-disable of the identity in ISC. I didn’t see this on the roadmap for future use of this feature. Will it be added?

I see lukas_ceremeta mentioned this in April. Just wanted to know if this is on the roadmap.

Thanks much.

[kirby_fitch]

@RArroyo

This is great news and easy to implement. What does not occur is the auto-disable of the identity in ISC. I didn’t see this on the roadmap for future use of this feature. Will it be added? Thanks much.

Hi @RArroyo I’ve got that ticket accounted for on my internal roadmap. Do you think it’d be appropriate to disable the ISC account both when the identity enters INACTIVE_SHORT_TERM and INACTIVE_LONG_TERM?

[RArroyo (Renee Arroyo)]

For our use it would be INACTIVE_LONG_TERM, however, for those using it for leave of absence, I could see INACTIVE_SHORT_TERM status as well disabling the ISC account.

[linuswareusafa (Linus Wåreus)]

Great feature if the INACTIVE_LONG_TERM also would disable the ISC-account itself.

However, currently we have deployed the INACTIVE_SHORT_TERM state on the ISC-admin accounts, so that they wont appear in any drop down lists when end-users requests access etc. (We only want to show the regular end-user accounts).

So if disabling the ISC-accounts in the INACTIVE_SHORT_TERM would disable the admin accounts as well, then another solution for hiding the admin accounts in drop downs etc. would have to be provided, since this is quite important for a good user experience and making it easy for our end-users (since our admins have dual accounts and end-user might pick to wrong one to order access to).

Alternately, only disabling the ISC-account in the INACTIVE_LONG_TERM would work, but the best solution would be the inactivate the ISC-accounts as fast as possible after a leave (but not disabling the admin accounts).

[sbhingare (sagar bhingare)]

Does “Inactive (Short term)” or Inactive(“long term”) Identities are considered as unlicensed ? How licensing cost is calculated each time when user’s LCS changes ?

[kirby_fitch]

@linuswareusafa

Great feature if the INACTIVE_LONG_TERM also would disable the ISC-account itself.

Thanks!

@linuswareusafa

However, currently we have deployed the INACTIVE_SHORT_TERM state on the ISC-admin accounts, so that they wont appear in any drop down lists when end-users requests access etc. (We only want to show the regular end-user accounts).

So if disabling the ISC-accounts in the INACTIVE_SHORT_TERM would disable the admin accounts as well, then another solution for hiding the admin accounts in drop downs etc. would have to be provided, since this is quite important for a good user experience and making it easy for our end-users (since our admins have dual accounts and end-user might pick to wrong one to order access to).

Thanks for sharing your goal. I recommend moving your ISC Admin accounts back to Active. There’s too much risk leaving them in that state should we add new features that further restrict INACTIVE_SHORT_TERM.

If we receive enough support from the community, we could consider hiding active segments of identities from lists.

[kirby_fitch]

@sbhingare

Does “Inactive (Short term)” or Inactive(“long term”) Identities are considered as unlicensed ? How licensing cost is calculated each time when user’s LCS changes ?

Use of this feature does not impact licensing at this time.

[sharvari (Sharvari Shah)]

@kirby_fitch

Attribute sync will always be triggered for Active and Inactive (short-term) identities.

Attribute sync will not be triggered for Inactive (long-term) identities…

Hi @kirby_fitch

Is this feature still in the works?

[kirby_fitch]

@sharvari

Is this feature still in the works?

YES! We’ll be rolling this out soon. Watch for release notes!

Attribute Sync will be skipped for Inactive (long-term) identities except when explicitly requested via an individual identity attribute sync (/beta/identities/:identityId/synchronize-attributes).

The updated filtering table will follow these rules.

Area	Active	Inactive (short-term)	Inactive (long-term)
Identity Picklists in Request Center	Included	Excluded	Excluded
My Team UI for Managers	Included	Excluded	Excluded
Scheduled Processing	Included	Included	Excluded
Apply Changes on Roles, Access Profiles, and Apps UIs	Included	Included	Excluded
Apply Changes on Identity Profiles UI	Included	Included	Included
Attribute Sync	Included	Included	Excluded
Processing for Select Identities	Included	Included	Included
Identity Attribution Promotion after Accounts Updated in Aggregations	Included	Included	Included

[adamian (Andrei Damian Fekete)]

@kirby_fitch

Watch for release notes!

Is there a reason not to integrate the table in the official documentation? (e.g. on the page Setting Up Lifecycle States - SailPoint Identity Services )

I find the overview useful, but I couldn’t find it in the documentation linked from the ISC product, and scrolling through so many comments is tedious.

[kaitlyn_stockton]

Hi Andrei! I work on the documentation for identities states. I plan on either adding a link to the table/graphic or including it in the docs in some form. Thank you for your feedback!

[adunker (Alex Dunker)]

@kirby_fitch - it would be great to add supporting the filtering in picklists for governance groups.

[ukputta (Uday Kumar)]

@kirby_fitch

Here are the areas we intend to expand this feature in the future. Submit questions or feedback about your top priorities .

• Certifications
• Access Modeling
• Login Capability
• Removing Requestable Roles
• Elsewhere

hi, I would like to check when this feature will be extended to other areas. Can you share a tentative timeline.

[kirby_fitch]

@adunker

it would be great to add supporting the filtering in picklists for governance groups.

@adunker, sorry, we must have missed that one. We’re taking up a work item to default this exclusion rule on all identity pickers. We’re making one exception for manual account correlation in the accounts UI. There, I think it makes sense to continue allowing inactives to be selected. Do you agree? Any other places you’d like to see an exception?

[kirby_fitch]

@ukputta

hi, I would like to check when this feature will be extended to other areas. Can you share a tentative timeline.

Hi Uday,

We’ve just expanded it to include attribute sync. Work to expand to AI modeling is in progress. I’m not able to speak to timelines for other areas. These other areas do remain a priority. Hope that helps!

CC @alec1 @SarahKhan

[cgurung (Chhiring Gurung)]

@kirby_fitch

attributes.identityState:ACTIVE

With Attribute Sync being excluded for inactive (long-term) users, is there a way we could force attribute sync to inactive users if needed ?

[kirby_fitch]

@cgurung

With Attribute Sync being excluded for inactive (long-term) users, is there a way we could force attribute sync to inactive users if needed ?

I’ve provided your options here:

Enhancement: Exclude Inactive Identities from Attribute Sync!

Description SailPoint is excited to announce that Inactive (long-term) identities will be excluded from the attribute sync process! This enhancement is available in all sandbox tenants. It will begin rolling out to production tenants on October 7, 2024. This enhancement was a top request following the initial release of New Capability: Management of Inactive Identities. Administrators will have more control over the the last update to leavers’ accounts, and see a reduction in unnee…

[ktggks (Sam Phan)]

@kirby_fitch

ou’re all waiting for this feature. I’ll keep updating thi

Hey Kirby! Great presentation at Navigate on this. Looks like this broke our termination process. We have a 180 day account retention process after someone leaves the company. Much of that process is reliant on attribute sync. Have you considered a Medium Identity State which would allow attribute sync but removes them from everything else?