How to reuse disabled AD child account?

[ASA]

We have following situation:

We have an AD system and are using ENDPOINTS_FILTER in connection, so we get multiple child endpoints.

Now if we remove all entitlements from a child endpoints account, that account is shown as disabled on next import, which is fine. Parent account stays enabled.

Question is, how can we reuse that account via access request. If we enable the child account, it creates a enable account task for parent account, which does nothing, because the account is already enabled. On the other hand we cannot request any entitlements for child account, because it is impossible to request for disabled accounts.

How can we resolve that?

[AmitM]

HI @ASA , you can create a default group in AD that you can add for all users of that child app. And , the account will never be removed / inactivated by import.  At the end Parent account is AD account and that itself is active. And, on termination you can remove the access. Also, AD account will anyways will also be affected by termination so that should be fine as well.

Second option is - Instead of inactivating child account , mark it suspended from import service using status and threshold config. Then user child account will be deleted if removed from all groups. One has to request again the new account and access. Saviynt will auto-complete the create account request if account name rule of child app is same as parent. Hence nothing to worry on will it try to create duplicate account etc..

You can choose one solution out of two - If you are giving access to AD groups , lets say , for a week (Just in time), then option 1 is better. If group membership is permanent and will only change once a year or very rarely then option 2 is better.

Thanks, Amit

Please ACCEPT SOLUTION if it helped.

[ASA]

Hi Amit,

thanks for the input!

Regarding option 2: What would we have to set in status threshold config to achieve this? The disabling of child accounts seems to be implicit, as the config is normally working on userAccountControl attribute from AD.

[AmitM]

Hi @ASA , two things in this :

The disabling of child account could be based on status and threshold config InactivateAccountNotInFile , this config will also be used by parent account. This will come into picture when parent account is deleted for parent endpoint OR when all groups are removed for child account. If you set this to false, this will mark child account deleted when your entitlement filter groups are removed from account. And user can request new account and access again. New account auto completes as explained in last post.

Second, Based on userAccountControl . This is for parent account, the actual account itself is disabled this time. And for this user has to re-enable account to get going. 

These two are different scenarios

BR,

Amit 

[rushikeshvartak]

"inactivateAccountsNotInFile": false,