Chat now with support
Chat with Support

Identity Manager 8.2.1 - Administration Guide for Active Roles Integration

One Identity Active Roles integration Synchronizing Active Directory using One Identity Active Roles Interaction with Active Roles workflows Interaction with Active Roles policies Managing Active Directory objects Configuration parameters for managing an Active Directory environment Default project template for One Identity Active Roles Active Roles connector settings

Deprovisioning Active Directory user account and Active Directory groups

One Identity Manager supports deprovisioning through Active Roles. Based on deprovisioning policies configured in Active Roles, an Active Directory object is modified such that it is temporarily or permanently disabled and possibly is not deleted until a certain time period has expired. For more information about Active Roles deprovisioning, see your One Identity Active Roles documentation.

NOTE: The deprovisioning policy configuration in Active Roles may conflict with the default One Identity Manager configuration. In this case, make any appropriate adjustments to templates or processes, for example.

The following procedures are implemented for deprovisioning Active Directory user accounts and Active Directory groups with One Identity Manager:

  • Deprovisioning not deletion

  • Quick deprovisioning

Detailed information about this topic

Deprovisioning not deletion

To implement this method

  • In the Manager, on the Active Directory domain, set the User accounts deleted by Active Roles workflows and Groups deleted by Active Roles workflows options.

If an Active Directory user account or an Active Directory group is deleted in One Identity Manager, a deprovisioning process is generated in Active Roles instead of the default deletion process. This process queues the Active Directory object for deprovisioning in Active Roles, sets a deprovisioned status, and checks the deprovisioning sequence. Active Directory objects continue to be processed in One Identity Manager depending this.

  • If the Active Directory object was deleted immediately in Active Roles, the Active Directory object is also deleted in One Identity Manager.

  • If the Active Directory object in Active Roles was renamed or moved to another Active Directory container, this is done in One Identity Manager as well.

    The Active Directory object remains in the One Identity Manager database with the status deleted.

NOTE: Active Directory user accounts and Active Directory groups that have the Protected from accidental deletion option set cannot be moved or deleted.

To delete a user account

  1. In the Manager, select the Active Directory > User accounts category.

  2. Select the user account in the result list.

  3. Click in the result list.

  4. Confirm the security prompt with Yes.

To delete an Active Directory group

  1. In the Manager, select the Active Directory > Groups category.

  2. Select the group in the result list.

  3. Click in the result list.

  4. Confirm the security prompt with Yes.
Related topics

Quick deprovisioning

You can apply this method if the Active Directory domain is not marked for deprovisioning. The Deprovision task is provided on these objects for the deprovisioning of individual Active Directory user accounts or Active Directory groups.

A deprovisioning process is generated in Active Roles. This process queues the Active Directory object for deprovisioning in Active Roles, sets a deprovisioned status, and checks the deprovisioning sequence. Active Directory objects continue to be processed in One Identity Manager depending this.

  • If the Active Directory object was deleted immediately in Active Roles, the Active Directory object is also deleted in One Identity Manager.

  • If the Active Directory object in Active Roles was renamed or moved to another Active Directory container, this is done in One Identity Manager as well.

    The Active Directory object remains in the One Identity Manager database with the status changed. All the Active Directory object properties are loaded in the One Identity Manager database by the next synchronization and set to published.

NOTE: Active Directory user accounts and Active Directory groups that have the Protected from accidental deletion option set cannot be moved or deleted.

To deprovision an Active Directory user account

  1. In the Manager, select the Active Directory > User accounts category.

  2. Select the user account in the result list.

  3. Select the Deprovision task.

  4. Confirm the security prompt with Yes.

  5. Confirm with OK.

To deprovision an Active Directory group

  1. In the Manager, select the Active Directory > Groups category.

  2. Select the group in the result list.

  3. Select the Deprovision task.

  4. Confirm the security prompt with Yes.

  5. Confirm with OK.

Related topics

Displaying information about deprovisioning Active Directory user accounts and Active Directory groups

The following properties are displayed for deprovisioning Active Directory user accounts and Active Directory groups:

Table 9: Deprovisioning data
Property Description

Deprovisioning status

Status of deprovisioning sequence through Active Roles when an object is deleted. The data is loaded from Active Roles on synchronization.

  • No deprovisioning: The Active Directory object is active.

  • Deprovisioning successful: The Active Directory object was successfully deprovisioned.

  • Deprovisioning failed: An error occurred while deprovisioning the Active Directory object.

Deprovisioning date

Status of deprovisioning sequence through an Active Roles when a object is deleted. The information is loaded from the Active Roles during synchronization.

To display main data of deprovisioning an Active Directory user account

  1. In the Manager, select the Active Directory > User accounts category.

  2. Select the user account in the result list.

  3. Select the Change main data task.

  4. Select the Active Roles tab.

To display main data of deprovisioning an Active Directory group

  1. In the Manager, select the Active Directory > Groups category.

  2. Select the group in the result list.

  3. Select the Change main data task.

  4. Select the Active Roles tab.

Related topics
Related Documents

The document was helpful.

Select Rating

I easily found the information I needed.

Select Rating