Guidance Needed for Cleaning Up Security Systems and Connections

[Roua]

Hi Saviynt Community,

I'm looking to clean up some security systems and connections that were created for testing purposes. After searching through the forums, I've found that deleting security systems directly in Saviynt isn't typically possible. There are a few approaches suggested, and I'd like to ensure I'm following the right steps.

From what I gathered, disabling the security system is possible with a query like this:

SELECT systemkey AS securitysystems__primarykey, 0 AS securitysystems__status 
FROM securitysystems
WHERE systemname = 'xxxxxx' AND status = 1
LIMIT 1;

https://forums.saviynt.com/t5/identity-governance/delete-disable-security-systems-and-endpoints/m-p/...

However, I have a few questions:

1- Disabling Related Objects: How can we delete or at least disable the accounts, entitlements, and anything else associated with this connection once the security system is disabled? I'm trying to ensure that nothing remains active or usable from these test connections.

Error when attempting to delete a connection, I'm encountering the following error:
"This Connection has been used in other modules (for eg: tasks, analytics etc) of this application. To retain the audit data and maintain data integrity, this connection cannot be deleted."

Is there a way around this, or a recommended approach?

2- Conflicting Information on Deletion: I've seen multiple posts suggesting that it is not possible to delete a security system. However, I came across this post that suggests it might be possible. Could someone clarify if and how this can be done?
https://forums.saviynt.com/t5/identity-governance/how-to-delete-endpoint/m-p/68968

3- Renaming the unused connections/endpoints/security system: If complete deletion from the UI isn't possible, how do we go about renaming the security system, endpoint, and connection to mark them as "DISABLED"? This would help us identify these systems as inactive and avoid accidental usage.

4- Renaming the used connection: 
i need to rename also the used connection would that affect anything attached to it ? (accounts, etc.. )
i am afraid to disable everything if the connection name get changed or the mapping would be affected

The connections I want to delete or disable are specifically for AD and LDAP.

Any guidance on the best practices would be greatly appreciated.

Thank you in advance for your help!

[indra_hema_95]

Hi @Roua I don't think Security System deletion is possible. You can make sure you disable instant provisioning and automated provisioning. Remove the connection from from security system. After that you can manually change account names through CSV or just can keep it like it. It won't affect anything anymore. But after that if you still want to disable the security system then you can create an enhance query job and put the query like mentioned above to disable it.

Regards,

Indra

[Roua]

thank you @indra_hema_95 ,
do you know if it is possible to rename both the used and unused connection also making sure that in the used one it wouldn't delete accounts or affect anything related to it? 

and basically you confirm that it is not possible to remove it from the UI so at least when requesting an access it doesn't appear there as an option etc.. ? 

[indra_hema_95]

Hi @Roua I hope you got the answer for connector, for the second point to make it not visible in ARS, under that security system go to the endpoint and make it non requestable. 

Regards,

Indra

[Roua]

thank you so much, @indra_hema_95 
it wasnt not clear to me if it is possible to rename the endpoints and security system as well 
also basically what i will do is i  renamed the connections and i will disable them.
and then create the query to disable the security system.
and by " disable instant provisioning and automated provisioning." you mean

? 
UPDATE: 
i renamed the displayname of them this should be fine but how to make sure 100%  it doesn't affect anything, by disabling the endpoints? using the query ? 

[indra_hema_95 · Accepted solution]

So, you can't edit the technical name, but you can change the display name.

In Security System you will able to find automated provisioning and instant provisioning 

For connection I haven't tried that usecase yet, so can't tell you the exact behavior, but if you are not putting that connector in any security system it won't affect anything. 

Regards,

Indra

[Roua]

thank you so much!! @indra_hema_95 

[rushikeshvartak]

• Simple solution - Disable connection it will disable all related objects - ss/ep/ ents / accounts
• https://forums.saviynt.com/t5/identity-governance/delete-disable-security-systems-and-endpoints/m-p/...
  
  

[Roua]

thank you @rushikeshvartak ,
that's by simply marking the status as disable from the connection config? 

is it possible to rename the used and unused connection ?  
and basically you confirm that it is not possible to remove it from the UI so at least when requesting an access it doesn't appear there as an option etc.. ? 

[rushikeshvartak]

• You can rename connection before making disable _unused also update description if needed
• and yes disable is button inside connection details page
• Yes if security system ever part of campaign/ reports then you can’t delete but it was never part of above two object then you can disable connection which will not show on ars.
• but make sure analytics query if using application then you should add proper status checks 

[Roua]

thank you @rushikeshvartak  for your help,
can you please elaborate on this " 

• Yes if security system ever part of campaign/ reports then you can’t delete but it was never part of above two object then you can disable connection which will not show on ars.
• but make sure analytics query if using application then you should add proper status checks 

", i didn't get it

[rushikeshvartak · Accepted solution]

• if its unwanted application try first deleting security system if you get error then disable connection.
• You can also rename endpoint display name 

[Roua]

@rushikeshvartak thank you sooo much really!
i did as you said, disabled the connection first since i got an error deleting the security system, after disabling the connection i tried to delete it and to delete the security system and i got this error again: 
This Security System has been used in other modules (for eg: request, attestation etc) of this application. To retain the audit data and maintain data integrity, this security system cannot be deleted.

[rushikeshvartak]

Yes you can't delete before connection disable or after if there is error ( means used in report / certification module)

[Roua]

aha and there is no way to resolve this error since we can't delete accounts, etc... right? 

[rushikeshvartak]

No

[Roua]

Thank you so much!