Unable to provision logical application to users with an account in parent endpoint

[SUMAIYA_BABU]

We have a few logical application created under Active Directory - say app1, app2. Active Directory is a birthright application for all users whereas app1 and app2 are request based.

Expected Behavior : When a user(who already has an account in Active Directory) requests for the logical application app1, the expectation is the new account task to auto complete since there is already an existing account in the parent endpoint(Active Directory). 

Actual Behavior: When a user (who already has an account in Active Directory) requests for the logical application app1, saviynt tries to create a new account and it fails because there is already an account already existing account in the parent endpoint(Active Directory). 

Analysis: We cannot use 'Entitlements Only' option in the 'Create Task Action' configuration at the security system because we have to trigger emails on AD account creation on birthright.

We also tried the option to complete the New Account task for app1 manually or through an extension query job, and then process the Add Access tasks - but in this case, we see an error 'WILL NOT PERFORM' for such tasks.

We have verified the account name rule for the AD and app1 are same.

[rushikeshvartak]

You need to use entitlementsOnly and what is your account name rule in parent in child ?

[SUMAIYA_BABU]

@rushikeshvartak I cant use Entitlements Only  because I need to trigger emails for New Account in case of birthright for AD. 

Account name rule is same for parent and logical endpoint - email

[rushikeshvartak]

Birthright will be there with entitlement u can send email based on birthright ent email

[rushikeshvartak]

Share both endpoint configuration screenshot

[SUMAIYA_BABU]

But in that case, it will sent emails on request based access provisionings as well, which we do not want. Also, I have emails to be trggered on account enable as well.

[rushikeshvartak]

• You can add arstasks.source condition

[SUMAIYA_BABU]

@rushikeshvartak Do you mean add condition in email template? Can you please explain?

[dgandhi]

You can discontinue such task using enhance query job.