Enable Account task is not creating for Inactive Account

[vermark]

Hi,

We have user update rule:

If Users.Custom Property 1 EQUALS "Enable"
Then
(Enable User Accounts)

We can see the update history of user the rule is getting trigger but the enable account task is not creating. Account Status is Inactive for that particular user.

[jayasudha]

Hi Vermark,

Greetings.. Could you please share the logs with us?

Thanks and regards,

Jayasudha R

[sundas7]

Hi,

Can you please check the useraccountcontrol attribute in Enable account JSON.

Please check the below documentation .

https://saviynt.freshdesk.com/support/solutions/articles/43000616186-changing-the-value-of-useraccou...

Thanks

Shyam

[rushikeshvartak]

[vermark]

This checkbox is already checked. Upon further checking i found that enable account task is not creating doesn't matter the account status is active or inaction. I tried updating the user from UI and Import as well, in both the cases rule ran but the task was created.

[vermark]

Corrcetion* The task was not created.

[rajesh-rams · Accepted solution]

Hi Vermark,

Greetings.

As per Saviynt's Life Cycle Management, 

• User Update Rules can create an enable account task, only if the Identity status is Active.
• Enforces the Governance Principle that the platform will create an Enable Account task for the account only if, the account status is Manually suspended (or) 2. If the account is already Active, the task wont get created. Any other Account status (inactive, in-active) is not supported.
• Enforces the Governance Principle that the platform allows only Disable Account / Remove Account / Remove Access on an Inactive User. Considering any other tasktype, either the task doesn't get created  (or) if the task is created via Analytics, it will get discontinued on running wsretry job.
• Enforces  the Governance Principle that the platform allows Add Access / Enable Account / New Account / Update Account on an Active User only. If the Identity status is inactive, either the task doesnt get created (or) if the task is created via Analytics, it will get discontinued on running wsretry job.

Coming to your case, Following are not clear with your post, It will be great if you could analyse in this direction. 

• Are you looking at an Inactive user?
• Is the Account Status is either Manually Suspended or 2?

[vermark]

Hi Rajesh,

Enable account task are created from user update rule. I tied with following scenarios.

1. Active Identity Inactive Account

2. Active Identity Active Account

When i am trying to enable the same (inactive account) from ARS the enbale account task is created for the same user. It's just that enable account task is not creating from user update rule though i can see in the update history of user the rule was triggered.

[vermark]

Correct* - Enable account task are not created from user update rule. I tied with following scenarios.

[vermark]

Hi Rajesh,

After changing the account status to 'Manually Suspended' during reconcile, the enbale account task are not getting created from user update rule.

Thank you for the assistance.

[rajesh-rams]

@vermark 

During Reconciliation, setting the status to Manually Suspended is not a recommended approach. Please set it to status 2.  Manually Suspended is a status set when the account is made inactive via Saviynt Platform.

If you want to suspend a user via Reconciliation, we need to set the account status with the value 2 for a suspended account.

• 1 defines - Active
• 2 defines - Inactive
• When account is just created, just enabled, status is set to Manually Provisioned. The next import will change this to 1 - Defining this as an active account
• When the account is just deleted / just suspended / just disabled, status is set to Manually Suspended. The next import will change this to 2 - Defining this as an inactive account.

Thanks