AD Endpoint / REST Endpoint Account Issues

[Sivagami]

We have Endpoint filter concept in connectors for AD and REST connector. This helps with the logic segregation of group of entitlements to be depicted as a separate application.

Let's consider I have an AD endpoint application consisting of 6 groups.  So, the endpoint account will get created when the user is part of any of these 6 groups. For example, let's say a user had one of this 6 groups and when the group he was part of is removed then the status of the AD endpoint account is changed to inactive from import as the user is no longer part of any of the 6 groups.

When the same user comes to saviynt to request access to the endpoint, they are not able to request as there is an inactive account associated with the endpoint. This is causing a lot of overhead and we are trying to find a solution for the same.

Appreciate insights on how to resolve the issue. We should let the user request access again.

Thanks,
Siva 

[avinashchhetri]

@Sivagami,

What is the default behaviour post account import after the groups are revoked, the account status is set to inactive or does the account status set as SUSPENDED FROM IMPORT SERVICE ?

[Sivagami · Accepted solution]

Adding statusAndThresholdConfig in AD and REST connector resolved the issue, Avinash!

{
  "statusAndThresholdConfig": {
    "statusColumn": "customproperty3",
    "activeStatus": [
      "true"
    ],
    "deleteLinks": false,
    "accountThresholdValue": 10000,
    "correlateInactiveAccounts": false,
    "inactivateAccountsNotInFile": false,
    "deleteAccEntForActiveAccounts": true
  }
}