HOW TO: Remove objects counted towards the Managed Objects total in Active Roles Licensing (4223966)

There may be a requirement to reduce the overall licensed user account total in an Active Roles environment. This will prevent using licenses when these objects are not in use and will prevent exceeding the total Managed Objects total.

NOTE: There is a scheduled task that runs daily at 3:30 AM called Managed Object Counter that updates the license count. This task can also be run manually for immediate results to reflect the changes.

SOLUTION

There is a built-in policy that excludes objects from the scope, thus making them Read-Only. The policy is called Built-in Policy - Exclude from Managed Scope.

This policy can be linked to any object, such as a Domain, OU, User, Group or Contact. Once it is linked, the target and anything under it become Read-Only. 

In an example scenario below, there are disabled users that need to be removed from the license count.

This can be accomplished by performing the following steps:

1. Create an Organizational Unit (OU) and move the disabled user objects into this OU
2. Navigate to the Built-in Policy - Exclude from Managed Scope found in: Configuration | Policies | Builtin
3. Double click the policy Built-in Policy - Exclude from Managed Scope
4. Select the Scope tab
5. Click the Scope... button
6. Add the OU where the disabled user objects were moved to and leave the Include Explicitly option as shown in the below picture
7. Select OK to commit the policy scope changes