Account Definition is not automatically getting assigned to user

Where exactly does the inheritance break?

• Does it work for some people or for nobody?
  • If it doesn't work for anyone, is the flag Employees do not inherit set at the location?
• Do you see the entries in PersonHasTSBAccountDef for the people that should get the account definition via the location?
  • If you don't see the entries for some people please check if the flag Person.IsNoInherite is set or if the person is marked as outstanding or to-be-deleted.
• If the account definition is assigned but the account is not created, please check the DB Queue and the job queue for errors.

Where exactly does the inheritance break?

• Does it work for some people or for nobody?
  • If it doesn't work for anyone, is the flag Employees do not inherit set at the location?
• Do you see the entries in PersonHasTSBAccountDef for the people that should get the account definition via the location?
  • If you don't see the entries for some people please check if the flag Person.IsNoInherite is set or if the person is marked as outstanding or to-be-deleted.
• If the account definition is assigned but the account is not created, please check the DB Queue and the job queue for errors.

• It is not working for all .The employee has Dynamic Role according to location.But Account definition is not assigning.
• I could see the entries in "PersonHasTSBAccountDef",but "XIsInEffect =false".The person is new user,value of "IsNoInherite" is false and not marked for deletion.
• NO jobs are there in JOb Queue

What is the Database Journal saying? Is the DB Queue processing halted (manually) or due to a missed compilation step? (You would notice the latter by the icons in the status bar of the rich clients).

where can i find the Database Journal

You can find it in Job Queue Info (as one option).

i checked there ,but no issues were found

If those generic tips don't help to solve the issue you need to contact support I guess.

I have found the issue,that in Person Object there is checkbox called" Security Risk".This has been enabled for those users.This is causing the problem for assigning Account Definition to user.

What is the use of this checkbox and how can we enable/disable this checkbox

This is one of the ootb features of the account definitions in One Identity Manager. You can control the behavior of the account definition assignment on the master data of it. Please check the documentation https://support.oneidentity.com/de-de/technical-documents/identity-manager/8.0.1/target-system-base-module-administration-guide/6#TOPIC-917170

You just need to activate the flag "Retain account definition on security risk" on your account definition if this is what your use-case demands.

Hi Markus,,

Thanks for your great help.I have one doubt.How it is getting enabled for user.In Which basis ,this checkbox is getting enabled.Where can we see the script

Which checkbox do you mean exactly?