Saviynt reqeusts need to be processed even if the users is being locked in the backend system

[AravindK]

Saviynt requests on locked users are being processed and completed in Saviynt, but not in the backend system (eg. SAP). This leads to a situation where Saviynt and SAP deviate. Saviynt shows the role assigned, but SAP backend not.

We need to make sure that Saviynt is capable to process request on adding or removing roles even if the user account has been locked due to several reason in the backend.The user do not know whether an account is locked or not, they just initiate requests which are being processed by Line Manager, Role Owner as well as Saviynt. If the account is locked, a mismatch between Saviynt and backend is happening. Users then cannot requests role assignments anymore as Saviynt shows the role assigned. User then need to request role removal (and approvals) to get it corrected and requests it again. This leads to confusion and waste of time.

We would like to know i if there is maybe a way to add some kind of pop up that will notify the user "your account is locked in one of the target systems and access will not be granted, please contact sap administrator"  like this??

[nimitdave]

Saviynt will not create add access tasks if the user or account is inactive. So are you saying that saviynt is creating add access task even if user or account is inactive.

If a account is locked in SAP then that status should be reconciled to saviynt for the account and account status in saviynt should be inactive.

[AravindK]

Hi ,
yes . User account is locked in the target system. Though user account is locked on target system,  Saviynt is allowing the user to raise a request.
Is there any way that I can configure this behavior so that Sav will not allow the user not to raise a request for any role if the an account is locked out in the target system?

[dgandhi]

Hi AravindK,

If the account is locked or Inactive in target then we will have to reconcile the status of the account and bring it back to Saviynt.

Once the status of the account in Saviynt is Inactive, it wont allow you to raise any request for the Inactive account. Also please do check below config at the endpoint level.

Thanks

Devang