Terminated user's provision from SuccessFactors to AD for a limited time

[michal_z]

Hi, 

I am using the out-of-the-box user provisioning service from SuccessFactors Employee Center to Active Directory (AD) described in this article Tutorial: Configure SuccessFactors inbound provisioning in AD. Some explanation about user provisioning attributes can be also found in this article: Microsoft Entra ID and SAP SuccessFactors integration reference  

Following the business requirements we need to delete the employee account from AD after 14 days since latestTerminationDate. 

Since I cannot make such a filtered scope in the Azure Enterprise Application configuration, I would like to ask an SAP expert like you, if it is possible to make a boolean custom field called i.e. "Delete from AD" which will be set by default to "False" and switch automatically to "True" when the following condition is met: latestTerminationDate < utcNow()+14 days.

If I could have such a field in SF I could make a scope only for users who have "True" as a value in this field. Otherwise, it will be out of scope and automatically removed from AD.   

Thank you for any tips or tricks on how to fulfill those business requirements. 

/Michal

[JakobDigranes]

We have a similiar task, we provision user accounts for deletion after 60 days. But the logic is in Microsoft Active Directory - rather than SAP. 

The process:
1. SAP SuccessFactors disable user account when AccountStatus is not: A P U 
Switch([emplStatus], "True", "A", "False", "U", "False", "P", "False")
(from this: https://me.sap.com/notes/2505526) 
2. Then we have a script running through our different users-OUs in Active Directory, looking for disabled accounts without timeStamp and set a timeStamp on account with todays date. The same script will also move disabled accounts with a timeStamp >60 days and move these accounts to OU=toBeDeleted
3. then another clean-up job runs and deletes user accounts from OU=toBeDeleted