Would 'AccountThresholdValue' count is only for Deleted threshold or any other Updates threshold ?

[manisha9084]

Hi Team,

Could you please let us know if  'AccountThresholdValue' is only to shield Deletion or it can shield any other updates too ?

For example, 

If we have set accountthresholdValue as 5000

1. We have 6000 account updates (Not deletion), will it come through ? 

2. If we have 10000 accounts not in file, will the job fail ? Or the job would be success and not a single account would be deleted ?

3. We have seen situation where, job becomes failed after sometime, and all accounts getting deleted as connection could not be established. Can this be avoided? 

All these questions are for Sp3.11 (PROD) and SP3.17(QA), so please answer accordingly to the versions.

Thanks

Manisha

[naveenss]

Hi @manisha9084 

Please find the response below

1. We have 6000 account updates (Not deletion), will it come through ?  - Yes it will come through. AccountThresholdValue is to avoid the deletions. Please see the screenshot below. Refer to the documentation below

https://docs.saviyntcloud.com/bundle/WD2-v55x/page/Content/Importing-Accounts-and-Access.htm

2. If we have 10000 accounts not in file, will the job fail ? Or the job would be success and not a single account would be deleted ? - Accounts will not be deleted in Saviynt. If there are no other errors during the import, the job will complete successfully.

3. We have seen situation where, job becomes failed after sometime, and all accounts getting deleted as connection could not be established. Can this be avoided? -> May I know which connector are you using?

[manisha9084]

Thanks

3. We have seen this issue in REST and AD.

[Imran]

Hi Naveenss,

As per the documentation we went through, the status threshold config JSON used in the connection are limited in importing the in-active/ deleted account or does it also serve the needs of updating the accounts during the recon?

[vivekmohanty_pm]

@manisha9084 @naveenss Please check the release note for v5-5-SP3-16: Enhanced Status and Threshold Functionality

From this version, when the account threshold is breached, the import job fails with an appropriate Job Response, and the missing accounts are not deleted/suspended in EIC. This is implemented for Active Directory, SOAP, Workday, Azure AD, Google Cloud Platform, ADSI, REST, Salesforce, and SAP in that version.

[Imran]

Hi Vivek,

As per the documentation we went through, the status threshold config JSON used in the connection are limited in importing the in-active/ deleted account or does it also serve the needs of updating the accounts during the recon?

[manisha9084]

Hi,

Yes I got this. But our PROD version is in 3.11.

My question was for any connectivity issue, The job sometimes is thinking as connection is lost, there is no account in file and even if accounts are active in backend, its deleting everything. 

So wanted to know in what use cases this might happen. And how can avoid this.

If job is not able to contact backend , then not delete accounts .

Thanks

Manisha

[vivekmohanty_pm]

@manisha9084 I understand your concern. As part of the same enhancement I mentioned earlier, this issue of marking accounts as SUSPENDED FROM IMPORT SERVICE when there is a network connectivity issue is solved. This fix is available from v5-5-SP3-16

Regards,
Vivek Mohanty

If this reply answered your question, please click the Accept As Solution button to help future users who may have a similar problem

[manisha9084]

Thanks.

We will try a way to test it out in QA which is in 3.17. 

Another question on the threshold part, What value should be kept ideally for the accountthreshold value ?

As the deleted accounts count in source would be increasing each day, So should it be estimated total number of deleted accounts in backend (old too) , or the value of deletion that we would be new to saviynt ?

Thanks

Manisha

[rushikeshvartak]

Ideal best practice 15% of total accounts. If 100 accounts then 15.

we should not care about count of deleted accounts, source and saviynt may have different counts. Example

• if import having condition pulling only active accounts then accounts may vary. 
• if account is created only in saviynt then in next import it will be marked as suspended from import service.

[manisha9084]

Hi Rushikesh,

Thanks for this. Lets say, we have some 1L accounts in AD as deleted in total. 

And in Saviynt, we have 1L Active Accounts, and already 1L Deleted Accounts, 1L Inactive Accounts. And expectation is some 1000 gets deleted or disabled in AD everyday.

So what should be threshold in this case ?

1. Should we consider the already deleted 1L accounts in Saviynt, thus threshold being 1L + ?

2. Or should we only consider what might get deleted + disabled per day in AD, thus threshold being 1000?

Thanks

Manisha

[rushikeshvartak]

You should consider what is maximum number account can be disable per day. So if maximum 200 accounts deleted from target then threshold can be 200

[manisha9084]

Thanks

Wanted to confirm once, if this threshold is only for Deletion or can stop bulk Disablement too ?

As we have seen in some testing that the disablement (10) is happening even if threshold is 6.

Thanks

Manisha

[rushikeshvartak]

Threshold is only for deletion.

[manisha9084]

Hi Rushikesh

But the first snapshot given by Naveens says its for deletion and inactivation too.

Is it like, if we select 'inactivateaccountsnotin file =false', it will consider delete. and if its 'true', it will consider 'Disablement' ?

Thanks

Manisha

[rushikeshvartak]

• inactivateAccountsNotInFile: Specify true or false to instruct the connector to mark accounts that are not imported during import as inactive or SUSPENDED FROM IMPORT SERVICE. When set totrue, accounts that are not imported during import are marked as inactive. The default value is false.

[manisha9084]

I understand this . But what I am trying to say is, in saviynt forums and the snapshot that I gave you, its written the threshold can limit disablement and deletion. So is it both or only deletion ? Does it decide on this attribute 'inactivateaccountnotinfile' too ?

So that, if lets say threshold is 100, and inactivateaccountsnotinfile=false, and accounts to be deleted is 200 --> It wont take any action. And if accounts to be deleted is 50, it will delete 50.

Now if, threshold is 100, and inactivateaccountsnotinfile=True , and accounts to be deleted is 200 --> It wont take any action, and if accounts to be deleted is 50, it will DISABLE 50.

Thanks

Manisha

[manisha9084]

And adding to below

So that, if lets say threshold is 100, and inactivateaccountsnotinfile=false, and accounts to be deleted is 200 --> It wont take any action. And if accounts to be deleted is 50, it will delete 50.

If in this case, Disablement is 200, will it disable all or not ?