Freeze/Unfreeze user account on Salesforce from Saviynt

[haardik_verma]

I am looking for a way to Freeze and Unfreeze a user account on Salesforce target system from Saviynt.

 We made a succesful connection and were able to create accounts on Salesforce.

We were also able to assign privileges from Saviynt only.

We were also able to disable account and remove those privileges from Saviynt only.

The above things were done using technical rules, as well as using request.

Now we are looking for a way to Freeze/Unfreeze Salesforce accounts from Saviynt.

Is there a way to do so? If yes, please help us by Sharing that.

Thanks

[sahajranajee]

Hi @haardik_verma ,

Our OOTB Salesforce connector supports Freeze/Unfreezing Salesforce Accounts. In Saviynt, this would translate to the account being locked/unlocked and hence has to be driven by the same mechanism.

On the connector, if you specify Freeze/Unfreeze on ACCOUNT_FIELD_QUERY, it maps the value to account's customproperty22 (Pre 2020.x) . In later versions, you can update the mapping to any CP in the FIELD_MAPPING JSON.

Once the above configs are enabled, you need to set STATUS_THRESHOLD_CONFIG and configure 'lockedStatusColumn' and its values there.

Then in order to enable locking/unlocking from ARS, set the Endpoint Configuration 'State and Status Fields' parameters.

Salesforce Connector Documentation : https://saviynt.freshdesk.com/support/solutions/articles/43000614765-salesforce-connector-guide

[haardik_verma]

Hi @sahajranajee 

Adding values like Freeze/Unfreeze or Freeze or Unfreeze in ACCOUNT_FIELD_QUERY was causing error in import jobs. All the accounts were showing as suspended from import service even when they were active in salesforce.

But removing it worked. 

*************************************************************************************************************

Configurations done for freeze/unfreeze to work from Saviynt is

1) Added "Lock" and "Unlock" in State and Status Fields in Endpoint page

2) Added the below in STATUS_THRESHOLD_CONFIG

"lockedStatusColumn": "customproperty22",
"lockedStatusMapping": {"Locked": ["1"],"Unlocked": ["0"]}

*************************************************************************************************************

Steps to Freeze/Unfreeze from ARS 

1) Request Access for Other or Request Access

2) Select user

3) In the 2nd step, you will see the Lock Icon. You can select that to take action

4) Approvals will be followed as per request access workflow.

5) "Lock Account" or "Unlock Account" type tasks are created

6) Make sure to add Lock account and Unlock account in Wsretry job.

*************************************************************************************************************

 @sahajranajee Can you please confirm if ARS is the only place from where we can Freeze/Unfreeze? I did not find any Lock/Unlock/Freeze/Unfreeze actions in Technical/UserUpdate Rules or Allowed actions of Analytics. How can we automate Freezing of users from Saviynt?

Suppose if we want to freeze all users based on their last login date or something? Please suggest

Thanks

[BG_IAM]

Hi,

I was able to freeze user accounts during termination by using an account update task in the user update rule. In the MODIFYACCOUNTJSON section, I set "isFrozen__c" to "${user.statuskey == 0 ? true : false}". This means that if the user's status is 0, then "isFrozen__c" is set to true (which freezes the account), otherwise it is set to false.

However, I am experiencing an issue with the Account Lock task. I configured it the same way as you described, and I can see that the tasks are being created properly. However, the tasks remain in status NEW and cannot be completed, even after several attempts.

Do you know what might be causing the issue and preventing the task from completing successfully?"

I hope this helps!

[This post has been edited by a Moderator to correct information as the author's request.]