I have configured Rapid Setup Leaver Processing in SailPoint IdentityIQ. The leaver process works correctly for Employee, Contractor, and Partner identity types.
However, it is not triggering for Service Accounts when an administrator changes the Service Account’s inactive attribute from false to true.
My IdentityIQ ObjectConfig has the following identity types:
employee
contractor
partner
rpa
service
My Rapid Setup Leaver trigger is configured for:
Inactive → Changed To → True
Could anyone help me understand:
Does Rapid Setup Leaver support type=service identities for Inactive → Changed To → True triggers?
Is there any additional Rapid Setup configuration required specifically for Service Accounts?
Could ManagerCertifierAttribute=administrator affect the Leaver trigger?
Are there any specific identity-processing or lifecycle-event configurations required for Service Accounts?
What would be the best way to troubleshoot whether the failure is at the trigger/event stage or the provisioning stage?
Hello Sathish. This looks more like a change-detection issue than a Service Account limitation. I do not see a Rapid Setup restriction that excludes type=service identities from the Leaver trigger.
I would check these first:
Confirm the Leaver trigger criteria include the Service Account population/type.
Run Identity Refresh with Process Events enabled.
Make sure Exclude identities marked inactive is not skipping the account after inactive=true.
If you use a date-based/delta refresh, enable Include modified identities in the refresh window. This helps include identities changed manually outside normal aggregation/refresh processing: Identity Refresh.
For Changed To, IIQ needs a previous state to compare against the current state. A similar Rapid Setup issue was reported where ChangeTo/ChangeFrom did not fire because the expected trigger snapshot was missing: related thread.
ManagerCertifierAttribute should not control whether the Leaver trigger fires.
For a clean test, set one Service Account to inactive=false, run the refresh, then change it to true and run Identity Refresh again with Process Events enabled. If no Leaver event is created, focus on the trigger/refresh side. If the event launches but the account actions fail, then troubleshoot provisioning.