Return
-
Title
Why Are "Outstanding" AD objects created in Identity Manager? -
Description
Identity Manager (1IM) is configured with Active Directory (AD) as the target system.
In Manager | Active Directory | Target synchronization: Active Directory, there are entries for ADSAccount, ADSAccountInADSGroup, etc.
In the case of ADSAccountInADSGroup, the listed users are members of respective AD groups in 1IM, but not members of the group in AD.
Why are these accounts listed as "Outstanding"?
Note: The object will appear under Target synchronization: Active Directory, e.g.:
And will appear in the group membership with faded icons, e.g.:
-
Cause
With regards to Group Membership (ADSAccountInADSGroup), this is defined, by default, in the mapping of group objects. Double-click the vrtMembersSIDArr property to view the configuration. By default, the "Try to mark the object for deletion (outstanding)" option is checked:
If the group member is removed in the target system, but not in 1IM, then the next time a sync runs, the object will be marked as "Outstanding".
With regards to ADSAccounts, it depends on how the synchronization has been configured. The default setting is defined in the workflow for synchronized objects, e.g.:
If users are deleted in the target system, they will be marked as "Outstanding" the next time a synchronization runs. -
Resolution
Group Membership (ADSAccountInADSGroup)
If the desired result is that group members are removed from groups, as per the above scenario, then clear the "Try to mark the object for deletion (outstanding)" option in the group mapping.
- Double-click the vrtMembersAll property to view the configuration. Clear the checkbox "Try to mark the object for deletion (outstanding)":
Users (ADSAccount)
If user accounts should be deleted during a sync when they have been deleted in the target system, update the workflow for user objects, as follows:
Please note: there may be complications due to assigned Account Definitions, or other configurations in place. Always thoroughly test configuration changes, as described above, in a test or development environment before applying in a production instance. Removing the group mapping setting notated above will not clear existing outstanding objects after a synchronization, those objects need to be handled manually via the Data Synchronization menu within Manager. -
Additional Information
Please refer to the Target System Synchronization Reference Guide for more information. https://support.oneidentity.com/technical-documents/identity-manager/9.2.1/target-system-synchronization-reference-guide/8#TOPIC-2199376