Issue with owneronterminate Feature - AD Update Account Task Not Triggering

[Chirag_Gupta]

Hello Everyone,

I am currently utilizing the owneronterminate feature in Saviynt, which allows me to change the manager during the user termination process. While I am able to successfully change the manager in Saviynt, I would like to also trigger an AD update account task when the manager changes. However, it appears that this task is not triggering as expected.

Could you please assist me in troubleshooting this issue? Any guidance on how to ensure that the update account task triggers correctly would be greatly appreciated.

Thank you!

Chirag Gupta

[rushikeshvartak]

• Currently ownership transfer does not trigger task in target.
• can you share current rule configs

[Amit_Malik]

Hi @Chirag_Gupta , owner on terminated only updates it in Saviynt.

You can have a discrepancy report created where attributes of user and address account are out of sync, and create update account tasks. That will sync user attributes with AD account 

[Chirag_Gupta]

Is it possible to directly trigger an update account task when the manager changes in Saviynt through Owneronterminate?

If not, we've already created the out-of-sync report for AD, how can I generate an update account task based on that report?

@rushikeshvartak @Amit_Malik 

Thanks,

Chirag Gupta

[Amit_Malik]

select distinct a.name,a.accountkey as acctKey, endpointkey, 'updateAccount' as Default_Action_For_Analytics from accounts a,user_accounts ua,users u,arstasks at where ua.userkey=u.userkey and ua.accountkey=a.accountkey and a.endpointkey='2' and a.endpointkey=at.endpoint and u.customproperty10 in

You can use above sample query and change it to you need. 'updateAccount' as Default_Action_For_Analytics, this part will create a update account task.

[Chirag_Gupta]

I have configured the runtime analytics. How can I trigger the update account task now?

SELECT
DISTINCT u.username,
CONCAT(
m.preferedfirstname, ' ', m.lastname
) as managername,
SUBSTRING(
a.customproperty21,
4,
LOCATE(',', a.customproperty21) -4
) as 'AD Managername',
a.name,
a.accountkey AS acctKey,
a.endpointkey,
'updateAccount' as Default_Action_For_Analytics
FROM
accounts a
JOIN user_accounts ua ON a.accountkey = ua.accountkey
JOIN users u ON ua.userkey = u.userkey
JOIN users m on (u.owner = m.username)
JOIN arstasks at ON a.endpointkey = at.endpoint
WHERE
a.endpointkey = '2'
AND CONCAT(
m.preferedfirstname, ' ', m.lastname
) != SUBSTRING(
a.customproperty21,
4,
LOCATE(',', a.customproperty21) -4
)
AND a.status IN (
1, 'active', 'manually provisioned'
)
and u.username between 00400101
and 00400125;

[Amit_Malik]

1) create analytics using sql query , using 'updateAccount' as Default_Action_For_Analytics

2) Create a Job as below. make sure to check the box that executes default action in query and creates task

make sure you have properly defined category and subcategory. You can create new subcategory also just for this report

[Chirag_Gupta]

There is no option available for Execute default action as analytics, Where can i find this option?

[Amit_Malik]

2) Create a Job as below. make sure to check the box that executes default action in query and creates task

You need to create a new Job. Job type is RunAllAnalyticsJob.

[Chirag_Gupta]

I created the job with below configs, and ran the job but still update account tasks for AD did not trigger.

Below is my query

SELECT
DISTINCT u.username,
CONCAT(
m.preferedfirstname, ' ', m.lastname
) as managername,
SUBSTRING(
a.customproperty21,
4,
LOCATE(',', a.customproperty21) -4
) as 'AD Managername',
a.name,
a.accountkey AS acctKey,
a.endpointkey,
'updateAccount' as Default_Action_For_Analytics
FROM
accounts a
JOIN user_accounts ua ON a.accountkey = ua.accountkey
JOIN users u ON ua.userkey = u.userkey
JOIN users m on (u.owner = m.username)
JOIN arstasks at ON a.endpointkey = at.endpoint
WHERE
a.endpointkey = '2'
AND CONCAT(
m.preferedfirstname, ' ', m.lastname
) != SUBSTRING(
a.customproperty21,
4,
LOCATE(',', a.customproperty21) -4
)
AND a.status IN (
1, 'active', 'manually provisioned'
)
and u.username between 00400101
and 00400125;

[Amit_Malik · Accepted solution]

SELECT
a.name,
a.accountkey AS acctKey,
a.endpointkey,
'updateAccount' as Default_Action_For_Analytics
FROM
accounts a
JOIN user_accounts ua ON a.accountkey = ua.accountkey
JOIN users u ON ua.userkey = u.userkey
JOIN users m on (u.owner = m.username)
JOIN arstasks at ON a.endpointkey = at.endpoint
WHERE
a.endpointkey = '2'
AND CONCAT(
m.preferedfirstname, ' ', m.lastname
) != SUBSTRING(
a.customproperty21,
4,
LOCATE(',', a.customproperty21) -4
)
AND a.status IN (
1, 'active', 'manually provisioned'
)
and u.username between 00400101
and 00400125;

a.endpointkey = '2' ---- Find out the endpoint key of AD endpoint from endpoints table. This is a sample I shared , your AD might not have key as 2.

Before running the job , check in dataanalyzer if query is returning anything

[Chirag_Gupta]

Endpointkey is also 2 for me, and the query is functioning correctly in the data analyzer. I've updated the query in analytics and executed the job, but the update account task still hasn't been triggered.

[Amit_Malik]

in the screenshot you shared, I have highlighted "Allowed Action", remove accept, revoke etc,... add update Account. Only Update account.

[Chirag_Gupta]

I updated the allowed action to include "update account" and ran the job, but the update account task still hasn't been triggered.

Thanks,

Chirag Gupta

[Amit_Malik · Accepted solution]

Select save data and not save in file. context as none.

Go to analytic history , search for your analytic and send below screen shots

click on conflicted count or view history and 

[Chirag_Gupta]

[Chirag_Gupta]

Hey Malik, thank you for your help! It’s working now, and I really appreciate your support.

[Dave]

@Chirag_Gupta - What is the solution? Either click on the "Accept As Solution" button on the reply that best answered your question, or provide the solution below to help others who may have a similar question. 

Thank you,
Dave

[Chirag_Gupta]

Hey Dave, I've already selected the reply as 'accept as solution' that helped me resolve this issue.