--- updatedAt: 2026-05-14T16:47:27.000Z --- # Active Directory provisioning [block:api-header] { "title": "Introduction" } [/block] This document provides instructions for configuring IBM® Verify User Lifecycle Management for an on-premises Microsoft® Active Directory. There are multiple components are required to be in place in order to manage provisioning with Active Directory, such as: * IBM Security Identity Adapter for Windows Active Directory * Onprem components such as Identity Brokerage, Postgres database and Verify agent (to be installed as containers) * LDAP Adapter profile for Identity Brokerage * Configure **Identity agent** in IBM Verify Refer to the [on-premise provisioning](https://docs.verify.ibm.com/verify/docs/on-premises-provisioning) in order to install various pre-requisite components [block:api-header] { "title": "Installing IBM Security Identity Adapter for Windows Active Directory" } [/block] The Active Directory Adapter is designed to create and manage accounts on Microsoft® Active Directory. The adapter communicates using Microsoft® ADSI API and PowerShell to the systems being managed. This adapter will be used to perform all provisioning requests via Verify Govern. The latest adapter information can be found at: Get the latest version details and part number for “**IBM Security Identity Adapter for Windows AD 64-bit with optional Exchange and Lync Support**” from above site and then download the installer from the [IBM Passport advantage](https://www.ibm.com/software/passportadvantage/pao_customer.html) site. Install the adapter on the on-premise Microsoft®Active Directory server. Once the Active directory adapter is installed successfully it creates the “**ISIM Active Directory Adapter**” service which listens to 45580 port. Please make sure to note the port number if it has been changed. Verify that “**ISIM Active Directory Adapter**” service is started successfully and its shown running status in Windows Services console. [block:image] { "images": [ { "image": [ "https://files.readme.io/060d5524b3079fefc647e5d437ed205c4262d638425d6835d421f0da92bc5e71-lifecycle-active-directory-AD_prov1.png", "060d5524b3079fefc647e5d437ed205c4262d638425d6835d421f0da92bc5e71-lifecycle-active-directory-AD_prov1.png", 1548, 741, "#d7dce1", null, "69dfa0a093cf71853fa0c12a" ] } ] } [/block] [block:api-header] { "title": "Configure the Active Directory Application for Provisioning" } [/block] After the required on-premise components are installed, **Active Directory** application need to be configured in IBM Verify. ## Create Active Directory application * Login to IBM® Verify as tenant admin (**Scott**) * Navigate to **Applications** page, click the **Add application** button [block:image] { "images": [ { "image": [ "https://files.readme.io/bd39a7232e6b6a9bf0ae1449972eab1d755e6eae5a17336ae11a87f2a258e044-lifecycle-active-directory-AD_prov2.png", "bd39a7232e6b6a9bf0ae1449972eab1d755e6eae5a17336ae11a87f2a258e044-lifecycle-active-directory-AD_prov2.png", 1857, 423, "#2f3a4f", null, "69dfa0a053225c488d7f2342" ] } ] } [/block] * On the **Select Application Type** dialog, enter **active** into the search box [block:image] { "images": [ { "image": [ "https://files.readme.io/e1e775a64f35ce3e7e584adc65e46d6089c1456c513cc58134204de5c451008e-lifecycle-active-directory-AD_prov3.png", "e1e775a64f35ce3e7e584adc65e46d6089c1456c513cc58134204de5c451008e-lifecycle-active-directory-AD_prov3.png", 957, 513, "#eaeaf2", null, "69dfa0a153225c488d7f2346" ] } ] } [/block] * When the *Active Directory* application is displayed, select it then click the **Add application** button * On the Add Application provide some **Company name** and click on “**Add owner**” to assign owner for the application [block:image] { "images": [ { "image": [ "https://files.readme.io/b4ba8f8d6fb5e881c78c2ddd9c4685a78a2253e3a344e7ca566f4299978d7580-lifecycle-active-directory-AD_prov4.png", "b4ba8f8d6fb5e881c78c2ddd9c4685a78a2253e3a344e7ca566f4299978d7580-lifecycle-active-directory-AD_prov4.png", 1153, 698, "#eff1f8", null, "69dfa0a13f302e8d4b218b37" ] } ] } [/block] * In the “**Select User**” pop-up, search for user **Jacob** (make sure that user is already created by the admin) * Select the listed user and click on “**OK**” [block:image] { "images": [ { "image": [ "https://files.readme.io/b7e79bd25a2f71f90e53f7768be6fbf84e0e5743efb47397231935a660ebdf70-lifecycle-active-directory-AD_prov5.png", "b7e79bd25a2f71f90e53f7768be6fbf84e0e5743efb47397231935a660ebdf70-lifecycle-active-directory-AD_prov5.png", 1031, 545, "#a3a3a4", null, "69dfa0a2dfa4c1d7c800b92c" ] } ] } [/block] ### Define Account lifecycle * Click on **Account lifecycle** tab * Enable **Provisioning** and **Deprovisioning** for accounts. Also provide value for **Grace period (days)** and **Deprovision action** [block:image] { "images": [ { "image": [ "https://files.readme.io/35773b6d47093b87af0101bd9b20bef77773c89fa9cdb3fb167d3774851963bf-lifecycle-active-directory-AD_prov6.png", "35773b6d47093b87af0101bd9b20bef77773c89fa9cdb3fb167d3774851963bf-lifecycle-active-directory-AD_prov6.png", 1035, 712, "#1d7cc0", null, "69dfa0a3c0861ac1c5d4a13c" ] } ] } [/block] * Scroll below and provide details for **API authentication** o *Agent URL* – Active directory adapter access URL (installed on the AD server) o *Agent user ID* – agent (default user, if changed use other) o *Agent password* – agent (default user, if changed use other) * Select the **Identity agent** from the dropdown [block:image] { "images": [ { "image": [ "https://files.readme.io/68575239ac0d58edead05aea89986403ebde655d52a401e552a3c6fa5707fc69-lifecycle-active-directory-AD_prov7.png", "68575239ac0d58edead05aea89986403ebde655d52a401e552a3c6fa5707fc69-lifecycle-active-directory-AD_prov7.png", 1065, 808, "#eeeff5", null, "69dfa0a4092343ce0fe191a6" ] } ] } [/block] * Scroll below and provide optional details for **User base DN** and **Group base DN**. If you do not provide the values then the root DN of the Active Directory server will be fetched * Click on **Test connection** to validate the configuration is correct for the various components [block:image] { "images": [ { "image": [ "https://files.readme.io/84bbb01648dd82ee1d5eea13ffd2c487a4a84091c771f16e32195fe69150d3aa-lifecycle-active-directory-AD_prov8.png", "84bbb01648dd82ee1d5eea13ffd2c487a4a84091c771f16e32195fe69150d3aa-lifecycle-active-directory-AD_prov8.png", 1111, 806, "#eeeff6", null, "69dfa0a4476db0e403cd9f7a" ] } ] } [/block] * If all the components are able to communicate properly then Success message gets displayed as: *The connection test was successful* * Scroll further below and validate the **API attribute mappings** as o sAMAccountName = *preferred\_username* o givenName = *given\_name* o sn = *family\_name* o mail = *email* o telephoneNumber = *mobile\_number* * Optionally select the “**Keep value updated**” checkbox against each attribute if the value of the attribute is always need to be kept updated with the source data [block:image] { "images": [ { "image": [ "https://files.readme.io/6f310afd9308e0783a72f551b7b12e9f843eacefb52c7de835fe21bfac6c4f30-lifecycle-active-directory-AD_prov9.png", "6f310afd9308e0783a72f551b7b12e9f843eacefb52c7de835fe21bfac6c4f30-lifecycle-active-directory-AD_prov9.png", 1077, 813, "#eff0f7", null, "69dfa0a553225c488d7f2377" ] } ] } [/block] * Click the **Save** button to save the changes to application ### Define adoption policy for account synchronization As we have successfully tested the connection with Active Directory server, lets define the adoption policy in order to synchronize the users and groups with IBM® Verify. The adoption policy determines how the accounts are matched as part of **account sync** operations. In order to define the adoption policy, click on “**Account sync**” tab from the details of Active Directory application. [block:image] { "images": [ { "image": [ "https://files.readme.io/5a0688c4613f440a6574fb74e96f2991bb1a314bf4f9bd0ee5b2e528b7d2bef9-lifecycle-active-directory-AD_prov10.png", "5a0688c4613f440a6574fb74e96f2991bb1a314bf4f9bd0ee5b2e528b7d2bef9-lifecycle-active-directory-AD_prov10.png", 1316, 530, "#eceff5", null, "69dfa0a53c068111295b7f61" ] } ] } [/block] * Click on **+ Attribute pairs** to add the attribute rule to be used to match the users from Active Directory with the existing users in IBM® Verify. Define the rules as: o sAMAccountName = *preferred\_username* o givenName = *given\_name* [block:image] { "images": [ { "image": [ "https://files.readme.io/32f78942f5e112502548e25de750feb42578cd0855b2f6ce0a1edf16e2baea85-lifecycle-active-directory-AD_prov11.png", "32f78942f5e112502548e25de750feb42578cd0855b2f6ce0a1edf16e2baea85-lifecycle-active-directory-AD_prov11.png", 935, 687, "#eeeff6", null, "69dfa0a6a5a41feac2e20ae0" ] } ] } [/block] [block:callout] { "type": "info", "title": "Account sync rule", "body": "The accounts will be matched on the basis on the attributes mapping defined in **Adoption policy** of Application. So, admin need to be careful while defining the attribute mapping." } [/block] * Click the **Save** button ### Define remediation policy for account synchronization Also define the remediation policy on the **Account sync** tab so that action need to be taken for the attributes which differ between IBM® Verify and the target application. Different remediation policies are: * Do not remediate non-compliant accounts automatically * Update IBM Verify with the target application's values * Update target application with IBM Verify values [block:image] { "images": [ { "image": [ "https://files.readme.io/ccb31ca5261d71212598465aeff56d687b426a2719656b03a9fbb731d65dbe1e-lifecycle-active-directory-AD_prov12.png", "ccb31ca5261d71212598465aeff56d687b426a2719656b03a9fbb731d65dbe1e-lifecycle-active-directory-AD_prov12.png", 1213, 312, "#cdd9d3", null, "69dfa0a6a5a41feac2e20ae4" ] } ] } [/block] * Select the policy as to **Update IBM Verify with the target application's values** * Click the **Save** button ### Define reverse attribute mapping Reverse attribute mappings determine how individual attribute values are transformed and stored with IBM® Verify after an account is matched successfully. It’s optional configuration and can be defined at attribute level. Click **+ Add attribute mapping** to define reverse attribute mapping. [block:image] { "images": [ { "image": [ "https://files.readme.io/2c59735fac8d9988faf8070a432a7323bdc69fc9f81c00702b9c0bf2e2cf499b-lifecycle-active-directory-AD_prov13.png", "2c59735fac8d9988faf8070a432a7323bdc69fc9f81c00702b9c0bf2e2cf499b-lifecycle-active-directory-AD_prov13.png", 1161, 303, "#edeff5", null, "69dfa0a79100f283663fafa2" ] } ] } [/block] * Click the **Save** button ### Set Owner, Attributes and Entitlements for Application When you saved above, a new tab (**Entitlements**) was exposed. Let’s define the entitlement so that user will be able to do a self-provisioning for account. * Click on the **Entitlements** tab * Update the entitlements for the application as **Approval required for all users and groups** * Also select the checkbox against the **Application owner** for approval [block:image] { "images": [ { "image": [ "https://files.readme.io/53b7bc9819c632f3cd06c37c7d6c1f4b30694683e503ba49f4468681bee9048b-lifecycle-active-directory-AD_prov14.png", "53b7bc9819c632f3cd06c37c7d6c1f4b30694683e503ba49f4468681bee9048b-lifecycle-active-directory-AD_prov14.png", 852, 508, "#166da1", null, "69dfa0a70fa99d91a0e0e942" ] } ] } [/block] * Click the **Save** button Active Directory application configuration is complete now. [block:api-header] { "title": "Account Synchronization with Active Directory" } [/block] After the **Active Directory** is successfully configured as mentioned in above section, tenant admin (**Scott**) can synchronize the Active directory users and groups with IBM® Verify. During the account synchronization, Active Directory accounts will get adopted based on the **adoption rule** defined while configuring the application. Make sure that tenant admin (**Scott**) has created a user having **username** as *Jessica* and **Given name** as *Jessica* in IBM® Verify. Also make sure that Active Directory has the user with **sAMAccountName** as *Jessica* and **givenName** as *Jessica* [block:image] { "images": [ { "image": [ "https://files.readme.io/1ab1c952e2b3d8d36e919ebde271db7b97b2e203b257960dd0a9ecff9d94d247-lifecycle-active-directory-AD_prov_acc1.png", "1ab1c952e2b3d8d36e919ebde271db7b97b2e203b257960dd0a9ecff9d94d247-lifecycle-active-directory-AD_prov_acc1.png", 510, 586, "#e6e6e5", null, "69dfa0a853225c488d7f23bb" ] } ] } [/block] In order to synchronize accounts: * Login to IBM Verify as tenant admin (**Scott**) * From the admin console navigate to **Applications** * Select **Accounts** from the three dot action menu against the **Active Directory** application [block:image] { "images": [ { "image": [ "https://files.readme.io/8138daba36c564a2158e7ddfdbd2a95152f0ea63413c6f18b152e78a8dc6b6e5-lifecycle-active-directory-AD_prov_acc2.png", "8138daba36c564a2158e7ddfdbd2a95152f0ea63413c6f18b152e78a8dc6b6e5-lifecycle-active-directory-AD_prov_acc2.png", 1842, 557, "#eaecf2", null, "69dfa0a85985d8d4d20bdb0d" ] } ] } [/block] * Click **Start account synchronization** [block:image] { "images": [ { "image": [ "https://files.readme.io/e4197e7a9d42d56d1b9f145fe3bfcee81055eb421656e56a0e9c6aa91e3089c1-lifecycle-active-directory-AD_prov_acc3.png", "e4197e7a9d42d56d1b9f145fe3bfcee81055eb421656e56a0e9c6aa91e3089c1-lifecycle-active-directory-AD_prov_acc3.png", 1838, 476, "#eaedf2", null, "69dfa0a9efb657e1663585a7" ] } ] } [/block] * In order to monitor the account synchronization operation, navigate to the **Governance** menu * Then click on **Account sync** tab * Click the **Refresh** button until the status of the account sync operation changes to *Completed* [block:image] { "images": [ { "image": [ "https://files.readme.io/9aaeab0ecaf56574f2c4d4649de4ed369f5f19ce0de7926dc39aed40deadba7d-lifecycle-active-directory-AD_prov_acc4.png", "9aaeab0ecaf56574f2c4d4649de4ed369f5f19ce0de7926dc39aed40deadba7d-lifecycle-active-directory-AD_prov_acc4.png", 1453, 432, "#ecf0f6", null, "69dfa0a928d6421a38fe37e5" ] } ] } [/block] * Click on the account sync row to view the details of sync operation. Right pane will show the details for accounts fetched from the Active Directory. It will also show the account details such as: **Compliant**– Accounts which got adapted and has all matching attributes as defined in application **Non-compliant** – Accounts which got adapted but has mismatch in attributes data **Unmatched** – Accounts which does not gets adopted with existing Verify users **Failed** – Accounts which failed to get synced [block:image] { "images": [ { "image": [ "https://files.readme.io/b4cbc0a29766d73736c6794b8ef21023dd6906b59a94a4a1f2a248a02ab224f4-lifecycle-active-directory-AD_prov_acc5.png", "b4cbc0a29766d73736c6794b8ef21023dd6906b59a94a4a1f2a248a02ab224f4-lifecycle-active-directory-AD_prov_acc5.png", 1882, 583, "#eaedf3", null, "69dfa0aa8f39fd59b9e28d14" ] } ] } [/block] [block:callout] { "type": "info", "body": "Accounts will be matched on the basis on the attributes mapping defined in “Adoption policy” of Application. So, admin need to be careful while defining the attribute mapping", "title": "Account sync rule" } [/block] * Click on **Account sync result** to view the results sync operation [block:image] { "images": [ { "image": [ "https://files.readme.io/7c24757bc5e6f144020fe3a45db33a6ceaa2b43affcf5593c34a09c7066682df-lifecycle-active-directory-AD_prov_acc6.png", "7c24757bc5e6f144020fe3a45db33a6ceaa2b43affcf5593c34a09c7066682df-lifecycle-active-directory-AD_prov_acc6.png", 1920, 1080, "#f1f1f8", null, "69dfa0aae5f108e8b5653e8d" ] } ] } [/block] Account sync result will show details of various accounts retrieved from the Active Directory. * Click on **View accounts page** to see details of various accounts [block:image] { "images": [ { "image": [ "https://files.readme.io/27650dc77818928fa2965960f050b642fa7f421774bb727dc7bfa40293e9f4a1-lifecycle-active-directory-AD_prov_acc7.png", "27650dc77818928fa2965960f050b642fa7f421774bb727dc7bfa40293e9f4a1-lifecycle-active-directory-AD_prov_acc7.png", 1857, 816, "#eaedf2", null, "69dfa0ab8f39fd59b9e28d48" ] } ] } [/block] * Click on the compliant account of *Jessica* which open user details in right pane [block:image] { "images": [ { "image": [ "https://files.readme.io/27eeec24992a71efa1d83a03f46ba739c93d5c070e4af64b537d9e82816365c2-lifecycle-active-directory-AD_prov_acc8.png", "27eeec24992a71efa1d83a03f46ba739c93d5c070e4af64b537d9e82816365c2-lifecycle-active-directory-AD_prov_acc8.png", 1833, 830, "#e9eef3", null, "69dfa0ac476db0e403cda081" ] } ] } [/block] * Click on **View details** to view remediation details (remember the remediation policy defined for **Active Directory** application in **Account sync**” tab) Remediation updates the IBM® Verify user record or the target application based on remediation policy [block:image] { "images": [ { "image": [ "https://files.readme.io/5a59b5d46e6fa9e202cc241f9e49ebfa7569b05fe6b75d7a2b2dee97db3938cf-lifecycle-active-directory-AD_prov_acc9.png", "5a59b5d46e6fa9e202cc241f9e49ebfa7569b05fe6b75d7a2b2dee97db3938cf-lifecycle-active-directory-AD_prov_acc9.png", 1039, 633, "#949596", null, "69dfa0ace5f108e8b5653eb2" ] } ] } [/block] You can validate the details of various users and perform the remediation action based on remediation policy defined at application level. Once the account sync is successful, all users and groups data from Active directory gets available in IBM® Verify which can be further used for role management or adoption etc. [block:api-header] { "title": "Provisioning with Active Directory" } [/block] First, let’s create a new user in IBM Verify and make sure he / she can log in. #### Create New User * Log to IBM® Verify tenant as your administrative user (**Scott**) * Go to **Users & groups** * Click the **Add user** button * Create a user. You can create any user you like (as long as it doesn’t clash with existing ones). **For example:** o Identity Source = Cloud Directory o User name = *podrick* o Given name = *Podrick* o Surname = *Payne* o Email = *a valid real email address* [block:image] { "images": [ { "image": [ "https://files.readme.io/369386a723900ba1839c737492b3f00ac4f611f624094f6f9275904a0ba4885d-lifecycle-active-directory-AD_prov_acc10.png", "369386a723900ba1839c737492b3f00ac4f611f624094f6f9275904a0ba4885d-lifecycle-active-directory-AD_prov_acc10.png", 933, 725, "#eef2f9", null, "69dfa0ad51d145550d02d1be" ] } ] } [/block] * Click the **Save** button to create the user [block:image] { "images": [ { "image": [ "https://files.readme.io/6e8bc661ca4652b9d677b3593de66d6a014e52e701b0ffbba0caaa7975960e98-lifecycle-active-directory-AD_prov_acc11.png", "6e8bc661ca4652b9d677b3593de66d6a014e52e701b0ffbba0caaa7975960e98-lifecycle-active-directory-AD_prov_acc11.png", 1627, 312, "#e9ecf1", null, "69dfa0ad8f39fd59b9e28d90" ] } ] } [/block] The user should get created and listed in the users table. #### Test the New User Can Login New user will get the initial password via e-mail. Go to your email client of newly created user and look for an email indicating a user has been created [block:image] { "images": [ { "image": [ "https://files.readme.io/f99b266e0a94a2254ff81f1b77fdc5ded1d5a6d9695cee8ed30a6714b2c72447-lifecycle-active-directory-AD_prov_acc12.png", "f99b266e0a94a2254ff81f1b77fdc5ded1d5a6d9695cee8ed30a6714b2c72447-lifecycle-active-directory-AD_prov_acc12.png", 842, 552, "#4478bc", null, "69dfa0ae94ab5a76f77e4ec6" ] } ] } [/block] * Open a new browser session, copy the link from the email and log in with the username and password from the email * When prompted enter a **New password** and **Confirm password** and click the **Change Password** button * Validate that user is able to access the Verify launchpad [block:image] { "images": [ { "image": [ "https://files.readme.io/9174f051784440ca26dfd78e4252ea927b418f043d0fbbb8bcd726ab9c314ecc-lifecycle-active-directory-AD_prov_acc13.png", "9174f051784440ca26dfd78e4252ea927b418f043d0fbbb8bcd726ab9c314ecc-lifecycle-active-directory-AD_prov_acc13.png", 1911, 432, "#f3f3fb", null, "69dfa0aecb02c24d2aba1913" ] } ] } [/block] [block:api-header] { "title": "Provisioning Use Case" } [/block] While creating the **Active Directory** application we have selected entitlement as **Approval required for all users and groups** and Approver as “Application owner”. So it has set the workflow where user can request access which need to be reviewed by the **Application owner** - *Jacob* #### Request new account * Log into IBM® Verify tenant as end user (**Podrick**) * Form the launchpad click on **Add app +** * Click **Request access** for the Active directory application [block:image] { "images": [ { "image": [ "https://files.readme.io/3cb70b8f93ca85453cb5f4904d90d596f2274b71ba08960b75e98717ccce8abd-lifecycle-active-directory-AD_prov_acc14.png", "3cb70b8f93ca85453cb5f4904d90d596f2274b71ba08960b75e98717ccce8abd-lifecycle-active-directory-AD_prov_acc14.png", 1898, 451, "#f3f3fb", null, "69dfa0afdbda11bbdb50cdcb" ] } ] } [/block] * Provide the **Justification** for access and **Submit** the request [block:image] { "images": [ { "image": [ "https://files.readme.io/41c2dc939e7d48fa5d47b496f6fae1a186f630241a0b55b39d904776b8be9f43-lifecycle-active-directory-AD_prov_acc15.png", "41c2dc939e7d48fa5d47b496f6fae1a186f630241a0b55b39d904776b8be9f43-lifecycle-active-directory-AD_prov_acc15.png", 958, 635, "#f3f3f3", null, "69dfa0af9914de74dde07225" ] } ] } [/block] * Once the request is submitted it will be shown as **Pending** [block:image] { "images": [ { "image": [ "https://files.readme.io/7092843fb31e047a56c9fb89d95ce99a90cf42a8f4e4d495c3271c15af0a4a37-lifecycle-active-directory-AD_prov_acc16.png", "7092843fb31e047a56c9fb89d95ce99a90cf42a8f4e4d495c3271c15af0a4a37-lifecycle-active-directory-AD_prov_acc16.png", 1862, 347, "#f3f3fb", null, "69dfa0b09914de74dde07229" ] } ] } [/block] * Click on **View Request** to see the details of request [block:image] { "images": [ { "image": [ "https://files.readme.io/d931da368fa760672615d1994ff5ec772da602f59c2f0d337de6342fe8a90c16-lifecycle-active-directory-AD_prov_acc17.png", "d931da368fa760672615d1994ff5ec772da602f59c2f0d337de6342fe8a90c16-lifecycle-active-directory-AD_prov_acc17.png", 1857, 406, "#eaedf2", null, "69dfa0b04ee8ce454cbfac37" ] } ] } [/block] The request is now pending for approval with the application owner (**Jacob**) #### Approve new account For the new account approval request, application owner / manager will receive the notification email as: [block:image] { "images": [ { "image": [ "https://files.readme.io/e5bd2a54666a71ad444dc83518857b40c10c6a535b6dcc5ccc272c3b161f5c74-lifecycle-active-directory-AD_prov_acc18.png", "e5bd2a54666a71ad444dc83518857b40c10c6a535b6dcc5ccc272c3b161f5c74-lifecycle-active-directory-AD_prov_acc18.png", 788, 434, "#487dc1", null, "69dfa0b126f6463cf2e78556" ] } ] } [/block] * Log into IBM® Verify tenant as Application owner (**Jacob**) * Form the launchpad click on **Task manager** tab which will show the pending application requests [block:image] { "images": [ { "image": [ "https://files.readme.io/edb0ba3a8ad10283575d68eee7b30b4867763695ab0bc5e79271025ce78022ba-lifecycle-active-directory-AD_prov_acc19.png", "edb0ba3a8ad10283575d68eee7b30b4867763695ab0bc5e79271025ce78022ba-lifecycle-active-directory-AD_prov_acc19.png", 1871, 387, "#eceff5", null, "69dfa0b1cdb5b8885e5c6780" ] } ] } [/block] * Click anywhere on the pending approval request for **Podrick** which opens the **Request details** in right pane [block:image] { "images": [ { "image": [ "https://files.readme.io/3c56a3d64887b72f2869210f1346e45cb8bbfc5a1d36874f5d7a053d759e3d13-lifecycle-active-directory-AD_prov_acc20.png", "3c56a3d64887b72f2869210f1346e45cb8bbfc5a1d36874f5d7a053d759e3d13-lifecycle-active-directory-AD_prov_acc20.png", 887, 873, "#ecedf4", null, "69dfa0b267e1d9986d23cb71" ] } ] } [/block] * Click **Approve** which opens the Approval popup [block:image] { "images": [ { "image": [ "https://files.readme.io/ab14fc4080051219504b346865bcaa3a6547e638b9d6a6fb66de67201cd92410-lifecycle-active-directory-AD_prov_acc21.png", "ab14fc4080051219504b346865bcaa3a6547e638b9d6a6fb66de67201cd92410-lifecycle-active-directory-AD_prov_acc21.png", 950, 492, "#f1f1f1", null, "69dfa0b3c489c75b5d73ae12" ] } ] } [/block] * Provide any additional comments and click **Approve** * As the account request gets approved, requestor (**Podrick**) gets the email for approval [block:image] { "images": [ { "image": [ "https://files.readme.io/b71331e17a7f95b3cc4ff125a8d8bf6fb3e2e7886b4b8c820a4b70df3e643cf7-lifecycle-active-directory-AD_prov_acc22.png", "b71331e17a7f95b3cc4ff125a8d8bf6fb3e2e7886b4b8c820a4b70df3e643cf7-lifecycle-active-directory-AD_prov_acc22.png", 851, 497, "#437bbb", null, "69dfa0b3476db0e403cda0d8" ] } ] } [/block] #### Validate new account As the account request gets approved, a new Active Directory account gets provisioned * Log into IBM® Verify tenant as end user (**Podrick**) * Validate the new account tile for **Active Directory** is shown on launchpad [block:image] { "images": [ { "image": [ "https://files.readme.io/164e1d432deb000eea1763b81536c7b2a7056a15a518e65dfb83f358938b9595-lifecycle-active-directory-AD_prov_acc23.png", "164e1d432deb000eea1763b81536c7b2a7056a15a518e65dfb83f358938b9595-lifecycle-active-directory-AD_prov_acc23.png", 1911, 545, "#f3f3fb", null, "69dfa0b4dfa4c1d7c800b94b" ] } ] } [/block] * Also, user **Podrick** will get the email having details of password for new Active Directory account [block:image] { "images": [ { "image": [ "https://files.readme.io/a3fe434085bdcc2f1326975ba4115dd40ed6b2fa02f92c3c08f40a9b893716b0-lifecycle-active-directory-AD_prov_acc24.png", "a3fe434085bdcc2f1326975ba4115dd40ed6b2fa02f92c3c08f40a9b893716b0-lifecycle-active-directory-AD_prov_acc24.png", 922, 422, "#437bbb", null, "69dfa0b4a0f6df02f1724f68" ] } ] } [/block] * Validate that new user gets provisioned on Active Directory as *Podrick* [block:image] { "images": [ { "image": [ "https://files.readme.io/1accf194bb0a5a999977414297c078958a6d65e37e7bdd7a539baebe7c5652cb-lifecycle-active-directory-AD_prov_acc25.png", "1accf194bb0a5a999977414297c078958a6d65e37e7bdd7a539baebe7c5652cb-lifecycle-active-directory-AD_prov_acc25.png", 1031, 698, "#dedede", null, "69dfa0b56a57c7600b4df8c1" ] } ] } [/block] * Validate various attributes of user gets provisioned as per the attribute mapping defined in Active Directory application Tenant admin (**Scott**) or application owner (**Jacob**) can also validate the account provisioning task details from admin console * Log into IBM® Verify tenant as Tenant admin (**Scott**) or application owner (**Jacob**) * Navigate to **Governance > Operation results** tab * Validate details for **Provision account** operation [block:image] { "images": [ { "image": [ "https://files.readme.io/19c3aa2f7d0b265f924c9b239752e8392a913725bc3a1d7e589617d93548500f-lifecycle-active-directory-AD_prov_acc26.png", "19c3aa2f7d0b265f924c9b239752e8392a913725bc3a1d7e589617d93548500f-lifecycle-active-directory-AD_prov_acc26.png", 1910, 932, "#e9edf2", null, "69dfa0b614c7a25e339f643f" ] } ] } [/block] ### Suspend User Account * Log into IBM® Verify tenant as your administrative user (**Scott**) * Navigate to **Users & groups** * Click on the user **Podrick** * Click **View full profile** link from right page * From the user details page click **Edit user information** icon [block:image] { "images": [ { "image": [ "https://files.readme.io/bc0da494fc0f080bdab55033865c0d1664b917423dfbf6dbeb2a9b85d704cd52-lifecycle-active-directory-AD_prov_acc27.png", "bc0da494fc0f080bdab55033865c0d1664b917423dfbf6dbeb2a9b85d704cd52-lifecycle-active-directory-AD_prov_acc27.png", 1187, 547, "#f2f2fa", null, "69dfa0b79c3c8e4abfe45b3a" ] } ] } [/block] * Update the status of the user to **disabled** and **save** the user changes [block:image] { "images": [ { "image": [ "https://files.readme.io/cb8ec4ffd7dd3eb7e1d907c9a131b18941b5d9979bfde56e56f9e78304127c23-lifecycle-active-directory-AD_prov_acc28.png", "cb8ec4ffd7dd3eb7e1d907c9a131b18941b5d9979bfde56e56f9e78304127c23-lifecycle-active-directory-AD_prov_acc28.png", 1186, 601, "#f2f2fa", null, "69dfa0b771b7ddb11c281387" ] } ] } [/block] * Log into IBM® Verify tenant as Tenant admin (**Scott**) or application owner (**Jacob**) * Navigate to **Applications** from admin console * Select **Accounts** from three dot menu against the **Active Directory** application * Validate user account for **Podrick** shows status as *Suspended* [block:image] { "images": [ { "image": [ "https://files.readme.io/1f9073d37a2f0b3353d3b98ba585fcfd1aab1c4931de4ec1a4068411a2801ca7-lifecycle-active-directory-AD_prov_acc29.png", "1f9073d37a2f0b3353d3b98ba585fcfd1aab1c4931de4ec1a4068411a2801ca7-lifecycle-active-directory-AD_prov_acc29.png", 1034, 312, "#e6e7ee", null, "69dfa0b820cfd9c021a3de7c" ] } ] } [/block] [block:api-header] { "title": "Deprovisioning use case" } [/block] * Log into IBM® Verify tenant as Tenant admin (**Scott**) * Navigate to **Users & groups** * Click on the user **Podrick** * Click **Delete** icon from right page * Confirm the **Delete** action * Make sure that user gets removed from Users list * Now, navigate to **Governance > Operation results** tab * Validate user account for **Podrick** shows status as **Scheduled** for **Deprovision account** operation [block:image] { "images": [ { "image": [ "https://files.readme.io/524e62718205a035533ac335aa383528b593e784a64af096a168d20ed19a6148-lifecycle-active-directory-AD_prov_acc30.png", "524e62718205a035533ac335aa383528b593e784a64af096a168d20ed19a6148-lifecycle-active-directory-AD_prov_acc30.png", 1440, 416, "#ebeef5", null, "69dfa0b871b7ddb11c2813a6" ] } ] } [/block] > 💎 [Nilesh Atal](https://community.ibm.com/community/user/people/nilesh-atal1), IBM Security