Playbook for Attempted Access to Deactivated Accounts

This playbook triggers when an employee whose account is terminated, disabled, or separated attempts to log in with their credentials. User’s identity state in Sail point generally gets updated to disabled on their termination date.

30 days is the ideal time from the termination date for it to get updated to a separated state. You can use business logic in Sail point to delete the RSA accounts and remove the Active Directory (AD) group memberships after 30 days.

• Set up the Attempted Access Deactivated Account playbook
  Use the following steps to set up the Attempted Access Deactivated Account playbook.
• Use the Attempted Access to Deactivated Accounts playbook
  Use this playbook when an employee whose account is terminated, disabled, or separated attempts to log in with their credentials. The following steps give you a walkthrough of the actions, tasks, and subflows that are available in the Attempted Access to Deactivated Accounts playbook.