User Suspension

[Naveen_Talanos]

Hi Experts,

Please help

How is user adhoc suspension managed in Saviynt.

My scenario is:

1. Manager should be able to put user in "Suspended" state, which is different user from "Disabled" user. This should be a feature to disable a user like through ARS. This should "suspend" user's account and related entitlements.

2. If now the user is "unsuspended", manager should be able to request this un-suspension from ARS and then all the suspended accounts and entitlements should be enabled at the same point where they were suspended.

Regards,

Naveen

[rushikeshvartak]

You can use one click disable for ad hoc suspension but you said disable is not required. once accounts is suspended Saviynt will not know what old access account was having.

In this case user account should be inactivated & reactivated for unsuspension

[Naveen_Talanos]

Actually I can use one click disable, but only if I am able to identify that "disable" as suspension somehow. Need to differentiate between normal disable and "suspension disable".

Also, one click disable is anyways making User status as "Inactive", can I add more statuses in "Status" dropdown? Also somehow need to make the account "Inactive", as you suggested, if it is "suspension disable".

Regards,

Naveen

[avinashchhetri]

@Naveen_Talanos,

You cannot add more user status to what's already there. Saviynt reognizes only two status's Active and Inactive.

What you caould perhaps do is, make use of customproperties to add your 'additional' status and then trigger user updates rules to disable accounts/access.

[Naveen_Talanos]

Thanks @avinashchhetri, makes sense.

Do you think I can achieve this as well?

On suspension if I make user's account inactive, say AD account which has 3 entitlements (2 active and 1 disabled), now when user is unsuspended, AD account should be enabled to same state with 3 entitlements (2 active and 1 disabled)? Like freeze and unfreeze....

Regards,

Naveen

[rushikeshvartak · Accepted solution]

You can achieve using below steps

1. Use Update User Request Form
2. Update some customproperty = Suspend
3. Use above customproperty and create User Update Rule
4. Based on User Update Rule Lock the AD Account

For Reactivate -

1. Use Update User Request Form
2. Update some customproperty = Unsuspend
3. Use above customproperty and create User Update Rule
4. Based on User Update Rule Unlock the AD Account

[Naveen_Talanos]

Thanks @rushikeshvartak looks like that will work. 

[avinashchhetri · Accepted solution]

@Naveen_Talanos,

What do you mean when you say an entitlement is disabled ? It is either Active or Not. 

Also as long as the account itself is inactive, would it matter if the entitlements are tied to the account, temporarily in this case ?

[Naveen_Talanos]

I realized that @avinashchhetri, you are right.

Thanks for your reply