We are using the out-of-the-box (OOTB) “Remove All Access” option to remove all entitlements except Birthright Roles as part of our leaver lifecycle process.
During termination, SailPoint attempts to remove the Domain User AD entitlement from the Active Directory account. However, the removal fails and the provisioning operation returns a WILL_NOT_PERFORM error.
To work around this, we tried including the Domain User entitlement in a Birthright Role so that it would not be removed during the initial leaver processing. However, after the 30-day retention period, when we need to fully deprovision or delete the account, SailPoint again attempts to remove the Domain User entitlement and encounters the same error.
We are trying to understand:
Why does the OOTB “Remove All Access” process attempt to remove the Domain User entitlement?
Is this expected behavior for Active Directory accounts?
What is the recommended approach for handling Domain User during leaver processing and eventual account deletion?
Has anyone encountered a similar issue and found a best-practice solution?
Yes, this is generally expected. The Remove All Access process attempts to remove all entitlements, and if Domain Users is being aggregated as an entitlement, ISC will try to remove it as well.
The issue is that Domain Users is typically the default/primary group in AD, so AD doesn’t allow it to be removed like a regular group and returns a WILL_NOT_PERFORM error.
In most cases, the better approach is to disable the account as part of the leaver process and handle account deletion later based on your retention policy, rather than trying to remove the Domain Users group.
I’d also check whether Domain Users can be excluded from governance or managed differently in your AD configuration.
this is expected behavior. If you want to retain that entitlement, you have a couple of options:
Use a before provisioning rule to remove the entitlement from the plan.
Alternatively, use workflows to manage access removal upon user termination, where you can filter and decide which access should be removed or retained.
Yeah, we are trying to disable account first and then after 30 days deleting the account so if we configure it as Birthright role having Domain User in it. Still during account deletion this would be tried by ISC to remove this entitlement. Just wanted to also know will there be any issue with this error? Does it retry to remove on each refresh or just one time try and throw error if Birthright role is removed by the time?
But still during account deletion would need to remove this entitlement, right? or we would be filtering this entitlement from plan during removal & account deletion and procced?
If you’re using the “Remove All Access” configuration from the UI during terminated LCS, you can filter out the removal of the Domain Users group using a Before Provisioning (BP) rule, or by leveraging a Service Standard Before Provisioning rule.
Alternatively, you can configure LCS to only disable the account and handle access removal separately through a workflow.
Keep in mind that Domain Users is a default group in Active Directory and typically cannot be removed, as it is the user’s primary group by default.
For a delete operation, you do not need to explicitly remove group memberships. Deleting the account automatically removes all associated group memberships.
Hi @ashwinVnair ,
If the Birthright Role is removed after the 30-day retention period, ISC will likely attempt to remove the Domain Users entitlement as part of the role removal process.
In general, ISC does not continuously retry the same failed entitlement removal on every aggregation. It typically makes the attempt when a provisioning event is triggered and records the failure if AD returns a WILL_NOT_PERFORM error.
The main thing to verify is whether this error actually prevents the account deletion. In many AD environments, deleting the account automatically removes all group memberships, so the Domain Users removal failure may simply be logged without impacting the deletion itself.
As an alternative, if account deletion needs to be handled differently, you could explore using an AfterModify rule with PowerShell to delete the account directly in AD. Since the account is removed entirely, its group memberships are removed as well, which may help avoid issues related to removing the Domain Users group.
Other way to do it - note the description for ‘remove all entitlements’
Set up role that provisions Domain users to users in the Inactive state who already have an AD account - that way, it won’t remove domain users, but it also won’t provision a new AD account if, for some reason, someone is in that lifecycle state and doesnt have an AD account
During delete, you don’t have to explicitly specify removing any group, deleting an account will take care of that. As other said, Domain Users is a default group which you can’t remove or do any governance.
