Disconnected application users group assign

[lakshman]

Ad groups should only be assigned to individuals who have been granted access to your disconnected application account. Similarly, in the case of deprovisioning, when the disconnected app account is removed, the Ad group should also be removed. Is there a way to address this scenario without relying on any analytics queries?

[Raghu]

@lakshman  For this scenario based on query condition you filter and create Task 

https://forums.saviynt.com/t5/identity-governance/add-access-actionable-analytics/m-p/66629#M41590

Sample:

select distinct a.accountkey AS 'acctKey', '656499' AS 'entvaluekey', u.enddate AS 'Termination Date', a.accountid, a.name as accName, u.userkey as 'userKey', u.username AS 'GUID', u.FIRSTNAME, u.LASTNAME, u.EMAIL AS USER_EMAIL, SYSDATE() AS RUNTIME, 'provisionaccess' as 'Default_Action_For_Analytics' from users u, user_accounts ua, accounts a, account_entitlements1 ae where a.status in ('ACTIVE','Manually Provisioned','1') and u.userkey = ua.userkey and ua.accountkey = a.accountkey and a.accountkey=ae.accountkey and a.endpointkey=XXX

[lakshman]

1. Raghu, your question is valid, however, the situation is acceptable as long as there is no analytics query required to perform the tasks of provisioning or de-provisioning access to users in a disconnected Active Directory-based application.

[rushikeshvartak]

Please use entitlement map concept for disconnected applications which will take care of add/ remove task of ad entitlement