Workflow trigger for AccountStatus Update

SailPoint Human Fabric (SHF) SHF Discussion and Questions
,
1

Hi, I am trying to implement below scenario and need some suggestion over it-
Scenario For a user-
1- Leaver process started(LCS= deprovisioned)
2- Ticket will be created for the disconnected sources(could be 100 of them for a single user)
3- Once the ticket is marked as Closed Complete, the account will be marked as Disabled automatically.
4- Once the account is disabled, we need to perform below things-
- If the lcs is deprovisioned and account is disabled, then delete the disconnected source account

Note: We are not doing any account aggregation, so cannot use Source Account update trigger.
We already have a powershell in place but wanted to explore the native IDN feature.
Please provide any suggestions if you have.

2

Usually, the account deletion of disconnected sources can be taken care of just through aggregation, where your new feed file does not have the user accounts anymore in the next aggregation.

But in your case, since you are not doing any account aggregation, you will have to delete the account programmatically or manually.

Please correct me if I am misunderstanding, but based on what you’re saying, a PowerShell script is scheduled to do just this: Find all users in the deprovisioned LCS, and if they have disabled disconnected accounts, delete those disconnected accounts on ISC by making an API call that deletes it.

I think this approach is okay as it is, but because you’re trying to do this natively, you can switch it out with a Workflow that has a scheduled trigger.

  1. Say, you schedule it daily, and you make an API call (Search query) through HTTP Request to get deprovisioned users.
  2. You then will have to loop through the result to fetch one user at a time, and then get that user’s accounts.
  3. If the account is disabled, then you want to delete the account (only if this account is a disconnected sources account, and to do this you need to keep an in-memory list of disconnected sources). This delete step can be a Manage Accounts action.

While you could theoretically achieve it through workflows like this, I would suggest avoiding all of this complexity and stick to a simple PowerShell script that is more flexible and easier to maintain.

3

Thanks for the response Sushant. I figured out another trigger “Provisioning Completed” which is able to suffice this. However, it will require asynchronous workflow to cater the larger number of source accounts.
So yes doing from workflow will be complex and messy. Keeping the powershell script is a go to option for now.