how to unmap users from account status SUSPENDED FROM IMPORT SERVICE

[Miko]

Hello Saviynt,

We have a requirement to disassociate mapped users from accounts that have "SUSPENDED FROM IMPORT SERVICE" status. We need to do this on a weekly base to clean up user mapping for deleted accounts.

How can this be done on actionable analytic report? 

v23.8

Thank you,

[rushikeshvartak]

You can map using analytics report . In order to unmap you need to do manually from  users - accounts - select accounts  and remove mappings 

[Miko]

Manual user-account unmap will be difficult for  thousands of accounts. Even after unmap, we need to do it frequently for ongoing suspended from import service account status.

Can this be done on Enhanced Query Execution job to remove mapping record from user_accounts table? If yes, can you provide delete query?

Thanks,

[rushikeshvartak]

Delete query are not supported by Custom Query / Enhanced Query Job.

Alternative workaround for suspended account change mapping to admin using enhanced query and then manually remove mapping from UI from Admin User

[Miko]

Thanks for providing this workaround. Yes, we can remove mapping from UI after we remapped to Admin User.

Is there a bulk action check box from User profile account section select all accounts ?  

Can you please provide me update query to change mapping to admin (ex userkey 1234)?

Thanks

[rushikeshvartak]

With enhanced query you can't do as user-accounts table having composite key which is not supported currently

[rushikeshvartak]

What is business impact of keeping SFIS accounts tag to user ?

[Miko]

There are many applications which have high turnover SFIS accounts status. Saviynt keep user-account mapping.  Users profile will have  accounts on their profile page along with SFIS accounts. Business do not want to keep user mapped SFIS after 30 days of account delete.

[rushikeshvartak]

This is only admin view to resolve issue you can cerate analytics report and show business account other than SFIS

[Miko]

Hi Rushikesh,

Can Account import  remove user mapping for SFIS accounts?  We tried to import accounts by giving blank user name value for the deleted account. However, it won't update existing user-mapping value.  If we give another user name, account import will replace the existing one

Can you advise on this?

Thanks

[rushikeshvartak]

No. You can't remove.

Write enhanced query to move SFIS account move under admin user in user_accounts table

[Miko]

Hi Rushikesh,

As per your suggestion, I tried to write enhanced query to update SFIS user-mapping to admin user in user_accounts table.  I am getting error when I tried to define enhanced query due to two primary key.

On Saviynt documentation it says user_accounts table has limitation on Update query. In addition, user_accounts table has two primary keys.  How do you define these two primary keys on update query?

example query

SELECT '789' AS user_accounts__USERKEY , ua.ACCOUNTKEY as user_accounts__PRIMARYKEY FROM user_accounts ua where ua.ACCOUNTKEY=123456;

Thanks,

[rushikeshvartak]

Yes only option left is you do it manually 

[Miko]

Currently, we have thousands SFIS and there will be ongoing activity to clear these data.

We can create analytic report to pull all SFIS along with securitySystem and Enpoint, then import it as schema based Account import.  To do this, we need the analytic report saved on Datafiles.

I tried to save the analytic report with this path, but it is not working /saviynt_shared/saviynt/Import/Datafiles

Can you suggest how we can drop analytic report on Datafiles so we can leverage to update usermapping using schema based Account data import?

Note: analytic report is being export as zip file as well. The need to be csv file as well

Thanks,

[rushikeshvartak]

You can migrate using custom jar using saviynt rest apis

[Miko]

Hi Rushikesh,

We prepared a report to create SFIS accounts lists from different Security Systems and Endpoints. See below.  How do we use import using schema based sav for multiple securitysystems.

As per Saviynt documentation, it seems like one sav file per security system? Can you advise how we can prepare one schema sav file to pull and map accounts to on any SecuritySystems and Endpoints?

Thanks,

[rushikeshvartak · Accepted solution]

Only 1 security system per sav file is allowed. and with this approach SFIS account will not be updated.

Use Saviynt REST API

Before

API : https://documenter.getpostman.com/view/23973797/2s9Ykhh4VH#0d5bacba-da39-4385-a07a-b76e06fc651a 

After