How group memberships are handled when user accounts are disabled or deleted depends on how you manage the user accounts.

Scenario: User accounts are linked to identities and are managed through account definitions.

• You use the manage level of account definitions to specify how group memberships of user accounts are handled when identities are temporarily deactivated, permanently deactivated, deleted, or pose a security risk.

Scenario: User accounts are linked to identities. No account definition is applied.

• If an identity is temporarily or permanently deactivated, the group memberships of the user accounts are retained.

• Use the QER | Person | User | KeepMembershipsOfLinkedAccount configuration parameter to specify deferred deletion behavior.

Overriding inheritance settings for individual groups

Sometimes it may be necessary to define different behavior for individual group. For example, it is possible to define never to automatically remove a group from user accounts or never to override the account definition settings.

You can specify behavior different from the default for the following group inheritance settings.

• Retain groups if temporarily disabled

• Retain groups if permanently disabled

• Retain groups on deferred deletion

• Retain groups on security risk

• Retain groups if user account disabled

Permitted values are:

• According to manage level: The manage level settings apply to the group memberships. You use the manage level of account definitions to specify how group memberships are handled when identities are temporarily deactivated, permanently deactivated, deleted, or pose a security risk.

  The setting takes effect for user accounts linked to identities and managed via account definitions.

• Never: The group is never inherited. Existing group memberships are removed. The group assignment is maintained but the assignment has no effect.

  The setting effects user accounts linked to identities. The setting takes effect regardless of whether the user accounts are managed via account definitions or not.

  IMPORTANT: If the Never value is applied to the Retain groups if user account disabled setting, the group memberships of user accounts that are not linked to an identity also become invalid.

  NOTE: This overrides the settings in the QER | Person | User | KeepMembershipsOfLinkedAccount configuration parameter.

• Always: The group is always inherited. Existing group memberships are remain intact.

  The setting effects user accounts linked to identities. The setting takes effect regardless of whether the user accounts are managed via account definitions or not.

  NOTE: This overrides the settings in the QER | Person | User | KeepMembershipsOfLinkedAccount configuration parameter.

To override inheritance settings

1. In the Manager, select the <target system type> > Groups > Override inheritance settings category.

2. To add a new group, in the result list, click .

   1. Next to the Group field, click .
   2. Under Table, select the table that maps the group.
   3. Under Group, select the group.
   4. Click OK.

   - OR -

3. To change the values for an existing group, select the group in the result list.

4. Enter the values for the inheritance settings.

5. Save the changes.

Related topics

• Temporarily deactivating identities

• Permanently deactivating identities

• Disabling and deleting using account definitions

• Deferred deletion of identities