Return
-
Title
Deprovisoned users are being added back to Provisioning Policy default groups -
Description
When deprovisioning users and the Deprovisioning Policy contains steps to move the deprovisioned users to a deactivated users OU and remove all group memberships, the default user groups defined in a separate Provisioning Policy are reapplied and the user is added back to the groups unintentionally.
The Change History for the deprovisioned user shows that the groups were removed, but they appear to remain.
-
Cause
The Provisioning Policy containing the group additions is applied to the deactivated user's OU, which is triggering the group additions when the deprovisioned user is relocated to the OU. -
Resolution
Un-link or block the Provisioning Policy on the deactivated users OU.