Whether unused user accounts can be disabled automatically or manually depends on the capabilities of the respective target systems and your company IT policies. Define processes suitable for notifying administrators, managers, or other responsible parties of unused user accounts and disable the affected user accounts.

To find and disabled unused user accounts

1. In the Designer, set the TargetSystem | UNS | UnusedUserAccountThresholdInDays | DaysUntilDisable and enter the value as the number of days after which unused user accounts should be disabled. The default value is 180 days.

2. (Optional) Assign identities to the Identity & Access Governance | Company policies | Exception approvers application role if they are to be informed about the user accounts involved. These are allowed to approve exceptions if necessary.

   Assign exception approvers

   1. In the Manager, select the Company Policies > Basic configuration data > Exception approvers category.

   2. Select the Assign identities task.

   3. In the Add assignments pane, add identities.

      TIP: In the Remove assignments pane, you can remove assigned identities.

      To remove an assignment

      • Select the identity and double-click .

   4. Save the changes.

3. (Optional) Check whether policy violation notifications are setup.

   For more information about this, see the One Identity Manager Company Policies Administration Guide.

4. Enable the working copy of the Unused user accounts can be disabled.

   Enabling working copies

   1. In the Manager, select the Company policies > Policies > Working copies of policies > Predefined category.

   2. Select the working copy in the result list.

   3. Select Enable working copy.

   4. Confirm the security prompt with Yes.
   5. Enable the original policy. Confirm the prompt with Yes.

   This starts the policy check.

   TIP: If an enabled company policy already exists, you can start the policy check with the Recalculate policy task.

   A predefined schedule starts the policy check once a month.

5. Check all the user accounts that violate the policy and disable them.

   • To automatically disabled unused user accounts, create target system-specific processes that run when new policy violations occur.

Related topics

• Behavior Driven Governance for target systems in the Unified Namespace
• Identifying and deleting unused user accounts