Accounts do not get synced during re-conciliation with Saviynt after being removed from the target

[ssingh16]

Hi Team,

We observed that the accounts for users that were removed from SAP (target application) were not synced in Saviynt for ECP SAP systems, and the accounts are still active in Saviynt.

We checked the logs and found that it shows that 1229 accounts need to be deleted, therefore exceeding the threshold limit of account inactivation processed at a time (the current threshold limit is 1000). In actual validation, we only see 4 accounts in Saviynt that are active in Saviynt but not present in SAP. It seems that for the threshold calculation, the system is also taking into consideration already inactive accounts in Saviynt; hence, the number is high.

We expect that already-inactive accounts should be excluded from the "to be deleted" calculation. We can look into increasing the threshold limit to get the account inactivation processed.

Could you please confirm that when accounts get inactive in Saviynt, then while removing the new accounts, the previous deleted account is considered or not? Does the threshold limit need to be raised in order to process account inactivation for the endpoints? 

Regards,

Satyam

[sai_sp]

@ssingh16 yes the limits needs to be increased if you have more accounts to be inactivated than the threshold. What tables are you importing and is this a full import?

[ssingh16]

Hello Sai,

Thanks for the information!

If we increase the limit now and in the future, it will exceed the limit again. That means every time we need to increase the limit of the threshold value to inactivate new accounts. Yes, this is a full-time import job, and the accounts, entitlements, roles, and groups we are importing form the tables.

Regards,

Satyam

[ssingh16]

Hi Team,

As we have mentioned above, if the number of new deleted accounts in the queue is greater than the threshold limit that is defined in the system, then we will increase the limit. But in this case, it considered the previously deleted accounts, and it shows that the limit is crossed, but actually there are only four accounts that are to be deleted in the queue. We believe that this is not the appropriate behavior.

Regards,

Satyam

[sai_sp]

@ssingh16 please share your STATUS_THRESHOLD_CONFIG.