This scenario describes how to configure a policy so that Active Roles permanently deletes deprovisioned groups after the 90-day retention period.
To implement this scenario, you must perform the following actions:
-
Create and configure the Policy Object that defines the appropriate policy.
-
Apply the Policy Object to a domain, OU, or Managed Unit.
As a result, after deprovisioning a group, Active Roles retains the deprovisioned group object for 90 days and then it deletes that object.
You can create and configure the Policy Object you need by using the New Deprovisioning Policy Object Wizard. For more information about the wizard, see Creating a Policy Object.
To configure the policy, click User Account Permanent Deletion on the Select Policy Type page of the wizard. Then, click Next.
On the Deletion Options page, click Delete the object after retention period. Then, in the box beneath that option, type 90.
When you are done, click Next and follow the instructions in the wizard to create the Policy Object.
You can apply the Policy Object by using the Enforce Policy page in the New Provisioning Policy Object Wizard, or you can complete the wizard and then use the Enforce Policy command on the domain, OU, or Managed Unit where you want to apply the policy.
For more information on how to apply a Policy Object, see Applying Policy Objects and Managing policy scope.
Policies in this category are intended to automatically generate and send e-mail notifications upon deprovisioning requests. The primary purpose of such a policy is to notify designated persons about a request to deprovision a given object so as to take additional deprovisioning-related actions on that object, if necessary. When configuring a policy in this category, you can specify a list of notification recipients, and customize the subject and body of the notification message.