Deprovisioning of service accounts

[Debankita]

Hi Team,

For the application EPM, we have some service accounts. Those service accounts are orphan accounts. Now, when we are trying to revoke access from these accounts the tasks are failing with message "user_login cannot be empty or null". 

For general accounts, we are passing the secondary email of the user's as their user_login for their EPM accounts but as those service accounts are orphan, Saviynt is unable to pass the user_login. 

Can anyone please provide a suggestion on how can these service accounts be handled. 

[rushikeshvartak]

You can pass 1 as userkey which is admin

[Debankita]

Hi @rushikeshvartak ,

We are using the out of the box Saviynt's EPM connector for reconciliation as well as provisioning for the application EPM.

We have configured the Revoke Access JSON as the following :

{
"USER_LOGIN": "${users.secondaryEmail}",
"ENTITLEMENT_TYPE": "${entitlementValues?.entitlementtypekey?.entitlementname}",
"ENTITLEMENT_VALUE": "${entitlementValues?.entitlementvalue}"
}

Now as the service accounts are orphan accounts, Saviynt is not able to send the "User_Login" field. But it is a mandatory field from the EPM end. Hence, the tasks are failing. 

Will you please elaborate your suggestion and also can you please explain what modification we can do from our end in order to resolve this issue.

[rushikeshvartak]

Since its ootb you need to raise support ticket it may be considered as enhancement