Update AD attribute when manager is terminated

Identity Security Cloud (ISC) ISC Discussion and Questions
1

Hello,

I need to create an automation within Sailpoint so that whenever a manager changes the lifecycleState to inactive, all service accounts associated with that manager have their manager changed to the manager of the disabled manager.

The source of the service accounts is pointing to an OU in Active Directory.

I need to try to do this via Sailpoint instead of creating an automation that goes directly to AD and changes the account attributes.

Can anyone help me on how to do this?

Thanks.

2

I am assuming that you have the inactive lifecycle set to disable AD accounts, if so you could use a Before Provisioning rule to catch the modification on the AD service account and do the following:

  1. Remove the change to disable from the provisioning plan
  2. Identify the new manager DN.
  3. Add the change to the manager to provisioning plan

The modification of the manager would then get processed automatically for these accounts.

On the next aggregation, the accounts should re-correlate to the new manager.

3

Hi @raibom

This can be achieve by creating the workflow in ISC.

Whenever the LCS state changes to inactive we can trigger an event to check if the Identity(Manager) has any service accounts and move it to the new manager.

4

Manager of an identity is set by Manager correlation in SailPoint, and this correlation is set in Auth source config (I am not aware of any other case). Hence, if you like to change the manager of a Service Account, then you need to create an automated process to update the auth source where the manager is set from.

2 Likes
5

You can use a static type transform on identity attribute manager to calculate active manager to achieve this. In one section of the transform you need to get manager lifecycle state using getReferenceIdentityAttribute. You then check if manager lifecyclestate is active or inactive. If lifecyclestate is inactive you can get manager’s manager value and return that, if not return manager value from the SOT.

6

@udayputta
The problem is that this way, I will have 2 different pieces of information. One manager in AD, and another in Sailpoint, since the sailpoint attribute is calculated.

7

This topic was automatically closed 60 days after the last reply. New replies are no longer allowed.