Insight - Track active and deleted users imported from user directory

Still need help?

The Atlassian Community is here for you.

Ask the community

Platform Notice: Server and Data Center Only - This article only applies to Atlassian products on the server and data center platforms.


Purpose

Companies using Asset Management applications and databases often track employees as assets. Built-in LDAP import functionality can be used to import the list of users into Insight and track them as assets. However, depending on Insight import configuration settings, Insight will of will not contain users who had been deactivated (deleted) in the user directory (e.g. Microsoft Active Directory).

This article explains how track historically which users had been recorded as active and then got inactive after they got removed from the user directory (e.g. after they left the company).

Example

Goal

  • After importing the users, mark newly imported users with Status = Active
  • Once a user has been removed from the user directory, mark the user with Status = Inactive in Insight, but keep the user recorded in the asset inventory.

Step-by-step

Create Status and Inactive attributes

  1. Create "Status" attribute (type: Status) that will have values "Active" and "Inactive":
  2. Create "Inactive" attribute (type: boolean) that will serve as an indicator of user presence in the user directory (this attribute will get updated accordingly during the import job):

Set up the import job

  1. Create the LDAP import job with the necessary primary configuration (LDAP connection, sync scope, etc.)
  2. Create an Object type mapping with the following configuration, that will update "Inactive" attribute value to "True" for missing object only (this will be the condition for the automation rule to kick in later and set Status of the user as "Inactive"). Note: Threshold Type and Threshold Number can be configured as desired.
  3. Map one LDAP attribute (which has a value that is always present in LDAP) to the "Inactive" attribute. In this case, we mapped "displayName" LDAP attribute to "Inactive" Insight attribute; if the "displayName" is present, the "Inactive" will be set to "False" value (this is how Insight import works with boolean attributes):
    screenshot-4.png

Set up the automation rule

  1. Create and enable an automation rule that will check Inactive attribute values.
  2. For every object that has Inactive = "True" and Status = "Active", the automation rule will update the object and set "Status" to "Inactive". An example automation rule configuration:

Result

Now, all users who get deleted from the user directory, will be marked as Inactive in your Object schema (after number of import events, and based on the import threshold). The users will not be deleted from Insight, so you will be able to track history of employees that move throughout your organization.

DescriptionInsight - Track active and deleted users imported from user directory
ProductInsight
Last modified on Oct 13, 2021

Was this helpful?

Yes
No
Provide feedback about this article
Powered by Confluence and Scroll Viewport.