Web Services SaaS: How to Handle Deleted Accounts in Delta Aggregation?

Identity Security Cloud (ISC) ISC Discussion and Questions
,
1

I am configuring a Web Services SaaS source in Identity Security Cloud and need clarification on how deleted accounts are handled.

In the older Web Services connector, there is a setting:

  • Account Delete Status Attribute
    • For example: isDeleted=true

So if the delta aggregation response contains an account with isDeleted=true, the connector can treat that account as deleted.

But in the Web Services SaaS connector, I do not see this setting. I only see:

  • Account Deletion
  • Enable Account Deletion
  • Percentage of Deleted Accounts Allowed

My understanding is:

  • For full aggregation, deleted accounts are detected when they are missing from the latest full aggregation response.
  • For delta aggregation, Web Services SaaS does not appear to have a UI setting to map a delete flag like isDeleted=true.
  • So a delta response containing isDeleted=true may only map that value as a normal account attribute, not actually delete/remove the account from ISC.

Can someone confirm the expected behavior?

Questions:

  1. Does Web Services SaaS support deleted account detection during delta aggregation?
  2. If yes, where do we configure the delete flag mapping?

Can we use the older Web Services connector with Direct Connection, without considering the VA, as an alternative to Web Services SaaS, or will it not work without VA?

Reference:

image
image786×246 11.6 KB

image
image1458×438 16.9 KB

2
  1. I don’t think delete-flag based delta deletion is supported on Web Services SaaS.
  2. Before/After Operation Rules also aren’t supported on WS SaaS (forum thread). You can try the SaaS customization path, Connectivity Customizers, but I wouldn’t assume that covers delete detection unless tested.
  3. I don’t think you can use the older Web Services connector without a VA.