Announcing the Saviynt Knowledge Exchange unifying the Saviynt forums, documentation, training,
and more in a single search tool across platforms. Read the announcement here.

Attributes that should not be modified in AD

Ivan5533
Regular Contributor
Regular Contributor

Hello,

I would like to ask you if there is any possibility to not modify a specific attribute in AD for certain users.

This is because there are attributes for old users that we cannot change.

For example, there are users that in the customproperty30 have the attribute "NO_UPDATE", is there any possibility that in the USERUPDATEJSON there are attributes that are not modified if the user to which the account belongs has NO_UPDATE in the customproperty30? note that this only applies to SOME attributes, not all, so I do not think it can be done at user update rule level.

How can we avoid modifying the facsimileTelephoneNumber and userAccountControl in users that have NO_UPDATE in the customproperty30 in the following USERUPDATEJSON (simplified)?

{
"givenname": "${user.firstname}",
"userPrincipalName": "${user.systemUserName+'@test.com'}",
"sn": "${user.lastname}",
"cn": "${user.displayname}",
"userAccountControl": "${if(user.statuskey == 1){'512'} else{'514'}}",
"manager":"${managerAccount.accountID}",
"postalCode": "${user.locationnumber}",
"facsimileTelephoneNumber": "${user.customproperty7}",
"mail": "${user.email}",
}

Thank you in advance

6 REPLIES 6

dgandhi
All-Star
All-Star

facsimileTelephoneNumber : "${if((user?.customproperty23=='NO_UPDATE')){accountName} else {user.customproperty7}}",

Try something like above, if CP23 = ' NO_UPDATE' then provision the same value which is present in the account (accountname is just for sample,) here I am assuming that you are brining that value from target(facsimileTelephoneNumber )and storing it in some account attribute , so use that account attribute here, and if it is not equal to NO_UPDATE then provision the CP7 value.

Thanks,
Devang Gandhi
If this reply answered your question, please Accept As Solution and give Kudos to help others who may have a similar problem.

rushikeshvartak
All-Star
All-Star

This is currently not supported for AD connector however supported for SAP connector only.

Upvote Idea - https://ideas.saviynt.com/ideas/EIC-I-5729 

Refer https://forums.saviynt.com/t5/identity-governance/retain-ad-account-attribute-for-a-specific-account...


Regards,
Rushikesh Vartak
If you find this response useful, kindly consider selecting 'Accept As Solution' and clicking on the 'Kudos' button.

Ivan5533
Regular Contributor
Regular Contributor

Hi guys,

Thanks for your replies. The best way to access the current value of the attribute in the account would be by accessing the task or directly to the account? e.g. task.accountKey.accounttype or account.accounttype ?

Kind regards,

Iván

In our project , we used account object.

Thanks,
Devang Gandhi
If this reply answered your question, please Accept As Solution and give Kudos to help others who may have a similar problem.

You can access either way. both going to provide same results


Regards,
Rushikesh Vartak
If you find this response useful, kindly consider selecting 'Accept As Solution' and clicking on the 'Kudos' button.

Ivan5533
Regular Contributor
Regular Contributor

Thank you guys!