Announcing the SAVIYNT KNOWLEDGE EXCHANGE unifying the Saviynt forums, documentation, training, and more in a single search tool across platforms. Click HERE to read the Announcement.

Enable Account task is not creating for Inactive Account

vermark
Regular Contributor
Regular Contributor

Hi,

We have user update rule:

If Users.Custom Property 1 EQUALS "Enable"
Then
(Enable User Accounts)

We can see the update history of user the rule is getting trigger but the enable account task is not creating. Account Status is Inactive for that particular user.

10 REPLIES 10

jayasudha
Saviynt Employee
Saviynt Employee

Hi Vermark,

Greetings.. Could you please share the logs with us?

Thanks and regards,

Jayasudha R

sundas7
Regular Contributor II
Regular Contributor II

Hi,

Can you please check the useraccountcontrol attribute in Enable account JSON.

Please check the below documentation .

https://saviynt.freshdesk.com/support/solutions/articles/43000616186-changing-the-value-of-useraccou...

Thanks

Shyam

 

rushikeshvartak
All-Star
All-Star

rushikeshvartak_0-1653969398581.png

 


Regards,
Rushikesh Vartak
If you find the response useful, kindly consider selecting Accept As Solution and clicking on the kudos button.

This checkbox is already checked. Upon further checking i found that enable account task is not creating doesn't matter the account status is active or inaction. I tried updating the user from UI and Import as well, in both the cases rule ran but the task was created.

vermark
Regular Contributor
Regular Contributor

Corrcetion* The task was not created.

Rajesh-R
Saviynt Employee
Saviynt Employee

Hi Vermark,

Greetings.

As per Saviynt's Life Cycle Management, 

  • User Update Rules can create an enable account task, only if the Identity status is Active.
  • Enforces the Governance Principle that the platform will create an Enable Account task for the account only if, the account status is Manually suspended (or) 2. If the account is already Active, the task wont get created. Any other Account status (inactive, in-active) is not supported.
  • Enforces the Governance Principle that the platform allows only Disable Account / Remove Account / Remove Access on an Inactive User. Considering any other tasktype, either the task doesn't get created  (or) if the task is created via Analytics, it will get discontinued on running wsretry job.
  • Enforces  the Governance Principle that the platform allows Add Access / Enable Account / New Account / Update Account on an Active User only. If the Identity status is inactive, either the task doesnt get created (or) if the task is created via Analytics, it will get discontinued on running wsretry job.

Coming to your case, Following are not clear with your post, It will be great if you could analyse in this direction. 

  • Are you looking at an Inactive user?
  • Is the Account Status is either Manually Suspended or 2?

 


Thanks
Rajesh Ramalingam
Saviynt India

vermark
Regular Contributor
Regular Contributor

Hi Rajesh,

Enable account task are created from user update rule. I tied with following scenarios.

1. Active Identity Inactive Account

2. Active Identity Active Account

When i am trying to enable the same (inactive account) from ARS the enbale account task is created for the same user. It's just that enable account task is not creating from user update rule though i can see in the update history of user the rule was triggered.

 

vermark
Regular Contributor
Regular Contributor

Correct* - Enable account task are not created from user update rule. I tied with following scenarios.

vermark
Regular Contributor
Regular Contributor

Hi Rajesh,

After changing the account status to 'Manually Suspended' during reconcile, the enbale account task are not getting created from user update rule.

Thank you for the assistance.

Rajesh-R
Saviynt Employee
Saviynt Employee

@vermark 

During Reconciliation, setting the status to Manually Suspended is not a recommended approach. Please set it to status 2.  Manually Suspended is a status set when the account is made inactive via Saviynt Platform.

If you want to suspend a user via Reconciliation, we need to set the account status with the value 2 for a suspended account.

  • 1 defines - Active
  • 2 defines - Inactive
  • When account is just created, just enabled, status is set to Manually Provisioned. The next import will change this to 1 - Defining this as an active account
  • When the account is just deleted / just suspended / just disabled, status is set to Manually Suspended. The next import will change this to 2 - Defining this as an inactive account.

Thanks

 


Thanks
Rajesh Ramalingam
Saviynt India