Search Query to get Duplicate AD accounts users

[atarodia (Animesh Tarodia)]

Hello @saikumar39,

Please refer to this comments here to get multiple account from a single source:

Get Users With More Than One Account in the Same Source

The query above will only work when limiting by authoritative source. The reason for this is that the top level source object on an identity object is that identity’s authoritative source. If you need to restrict your query to a non-authoritative source, then you will need to use the following query. { "query": { "query": "@accounts(source.id:2c918088814e6a610181686b56977fa8)" }, "indices": [ "identities" ], "aggregationsDsl": { "accounts": { …

Get Users With More Than One Account in the Same Source

We recently assisted a customer with a search api aggregation that can be used to detect sources with multiple accounts. Based on that engagement we’ve updated the DSL query and wanted to provide an example and some clarification. This aggregation consists of two term buckets which are group counts for each value found in the search aggregation - in this case the source bucket and duplicate accounts bucket. The main question asked was can the list of accounts be paged if the number of bucket…