Orphan Account Certification

[tuhink]

We have a requirement that the orphan accounts need to be certified. If the certifier revokes the account, it should be disabled. I was trying to create Application Owner Campaign where I have used the below queries to get the orphan accounts/mentioned specific accounts in advanced config.

accountkey in (select ACCOUNTKEY from accounts where ENDPOINTKEY=123 and status in (1,'Active','Manually Provisioned') and name not like 'abc-%' and ACCOUNTKEY not in (select distinct ACCOUNTKEY from user_accounts))

or

accountkey in (123,1234)

When I launch the certification, it only shows the entitlements of those accounts; it doesn't show the base accounts to certify.

Below are the config details. Please help how can I make changes to this config to include the base accounts as well.

[rushikeshvartak]

Since its orphan it won’t show

https://forums.saviynt.com/t5/identity-governance/active-orphan-accounts-application-owner-campaign/...

[tuhink]

@rushikeshvartak thank you for your quick response. Is there any other way around to certify the orphan accounts only?

[rushikeshvartak]

Using service account certification

[tuhink]

Tried with that as well. But after launching the certification its getting 100% completed. The Primary Certifier is set up in the orphan accounts. Do I need to make any other changes?

[rushikeshvartak]

Account Type and Account owner is mandatory 

[NM]

@tuhink , application owner campaign shows base account.

[NM]

Hi @tuhink can you map the orphan account to admin and then check if it gets pulled in certification.

[dgandhi]

Orphan accounts will be included by default in the application owner campaign. Remove the advance query that you gave and see if orphan accounts are included or not.