Manager has multiple AD accounts - select primary account of manager while user provisioning

[saima]

Hi Experts,

We have ADSI connection configured,

Basically user provisioning to AD is based on manager's primary account's DN- 

If a user' s manager has multiple AD primary accounts, how can we get the particular primary account of manager using managerAccount object in createAccount json?

please provide your inputs on this.

[NM]

Hi @saima you can't get it directly.. as a workaround you can do for primary account add account type as primary the when you fetch via manager account it should pick that.

Or 2nd option via dynamic attribute.

[rushikeshvartak]

• How do you decide primary manager ?
• You can use 

  ${usersManagerObj?.username}

  https://docs.saviyntcloud.com/bundle/EIC-Connectors/page/Content/Binding-Variables-for-Provisioning-...

[saima]

Hi Rushikesh,

We want to get the primary AD account of manager during AD provisioning. Manager has 2-3 normal AD accounts, where saviynt is not able to detect the account to be used for user's provisioning.

As user's provisioning is based on manager's AD account OU.

[rushikeshvartak]

what is attribute to identify its primary account ?

[saima]

we don't have a attribute to identify but we have a base OU, can we make use of managerAccount object anyhow? to get the primary account?

[NM]

@saima store primary account OU or DN in users manager profile.

If you can't identify you won't be able to get the right value ..

Or use dynamic attribute as stated above.

[rushikeshvartak]

even if we make use of managerAccount , You need identifier to identify which account to use

[saima]

Hi NM and Rushikesh,

If we somehow identify primary account by populating AccountType as Primary, how we can ensure managerAccount will always pick the primary account?

or is there any expression to get the primary account from manager and get it on some random customproperty?

[rushikeshvartak]

You need to write logic based on customproperty where you will store

[saima]

ok also - If we somehow identify primary account by populating AccountType as Primary, how we can ensure managerAccount will always pick the primary account?

[rushikeshvartak]

You can define Account Type = Primary Account under Endpoint

https://forums.saviynt.com/t5/identity-governance/leveraging-primary-account-type-for-users-having-m...

[stalluri]

@saima 

We are using the Account Type attribute and populating the value for all the primary accounts as Primary. 

 Leave it blank for secondary and service accounts

 In the Endpoint we will select this as below.

At the time of provisioning it will only pick the primary account and provision the user_account.