Duplicate Entitlement

[ant]

Hi

if an Active Directory group that exists in Saviynt is relocated to a different organizational unit and the import process is run again?

Will the group and its linked accounts be imported once more or will a duplicate group be generated, one with an "active" status without accounts and the other with a status of "none" but with accounts?

[sk]

It depends on your groupImportMapping mapping. If you mapped entitlementid field with AD DN then it will create another entitlement and old entitlement will get inactive. If you have performGroupAccountLinking set to true then during group import itself it will pull the respective membership.

[rushikeshvartak]

every group having unique dn hence it should not create duplicate entitlements. If its creating share logs and mapping

[timchengappa · Accepted solution]

When a group is moved to another OU in AD, the DN changes for the group but the GUID remains the same.

If you have configured objectGuid as the reconciliation field(which is also a best practice) then a duplicate will not be created.

PFB the screenshots, where a group was moved from one OU to another. The DN was changed 
but the entitlement ID remains the same and hence only the metadata for the group was updated without creating any duplicates. The EntitlementValueKey in the URL(15512555: Internal primary reference to the group object) is the same but DN was updated.

Original Group


After Group was moved to another OU


If you configure DN as the reconciliation field, it will create duplicate entitlements in EIC and in-activated the original group in Saviynt