Inactive Account Disable - Automation

[bazenic]

Hi, 

We are trying to disable the user in Saviynt. We've tried setting up the analytics report for this purpose where the query detects users who have not logged in for 90 days. The query works, however, after running the corresponding task - nothing happens (accounts stay in Saviynt). I was following this post for setting it up. 

1) Can someone explain how can we delete accounts that are inactive in AAD?
2) Do all users must have Sav4Sav accounts in order for this to function properly?
3) Is it feasible that we just disable an AAD account and that gets imported to Saviynt? 
4) What is the best solution for this? 

On top of that, the entire process of deprovisioning accounts is not clear to us, so if anyone can explain it, it would be much appreciated. 

Thanks! 

[adriencosson]

Hi @bazenic ,

If you want to "Delete" an account on a target application, you would need to perform the "Deprovision Account" action which will create a "Remove Account" task, that will perform the appropriate actions described in your Connector.

If you're using a REST connector, it will pick up the "RemoveAccountJSON" where an API call must be configured to delete the account accordingly.

If you're using a standard connector, you can give it a try, but not sure if this is as configurable as a REST connector.

For your concerns : 

2) Do all users must have Sav4Sav accounts in order for this to function properly? > No it is not mandatory
3) Is it feasible that we just disable an AAD account and that gets imported to Saviynt?  > Yes it can be done on the connector level if there is a Status Threshold Config option. This implies imported account is disabled - otherwise you need to do it through analytics using the same logic with "Disable Account" operation.

Hope this helps !