ADSI Reconciliation not changing the Account status in Saviynt

[sdey_2023]

Hi Team,

We have the StatusKeyJSON defined as follows:

 {
"STATUS_ACTIVE": ["512", "544", "66048"],
"STATUS_INACTIVE": ["546", "514"]
}

and the Status_Threshold_Config as below:

{
"statusAndThresholdConfig": {
"statusColumn": "custompropertyx",
"activeStatus": ["512", "544", "66048"],
"deleteLinks": true,
"accountThresholdValue": 1000,
"correlateInactiveAccounts": true,
"inactivateAccountsNotInFile": false
} }

but when we are running the import/recon job from ADSI to Saviynt, the accounts which were provisioned or disabled are not changing status to 'Active'/'Inactive' instead they are still having the status as 'Manually Provisioned'/'Manually Suspended'.

Could you please let us know if any config is missing which needs to be checked additionally?

[sudeshjaiswal]

Hello @sdey_2023 ,

Can you please confirm which attribute you are using as the reconciliation attribute for imports?

For Ref:-
https://forums.saviynt.com/t5/identity-governance/active-directory-account-status-not-being-updated-... 

[nimitdave]

So as per your status threshold json , custompropertyx should be storing UAC values like 512,514 etc. Are you able to see the values in  custompropertyx?

StatusKey json is for user imports , so no relation to account import.

[sdey_2023]

Thanks both of you for sharing the insights.

@nimitdave , yes the custompropertyx of Accounts is storing the User Account Control values like 512, 514.

@sudeshjaiswal , we have the objectGUID used as the Reconciliation field.

Please find the required Account attribute mapping as follows:

CUSTOMPROPERTYx::useraccountcontrol#String,

STATUS::useraccountcontrol#String,

CUSTOMPROPERTYz::objectguid#String,

RECONCILATION_FIELD::CUSTOMPROPERTYz

The same Custompropertyx is being used in the Status_Threshold_Config JSON as well.

[SB]

Can you check in the job log for the below entry and see if there is any warning for threshold around this block. This entry should be close to the end of the job logs.

Query to get accounts to be active