Persons marked as outstanding still have their account definitions and resources assign through dynamic rolesmark

Thing is, that the system does not re-calculate inheritance for outstanding objects do avoid unnecessary/unwanted changes. The outstanding status is normally something unwanted and should not be used in regular operations.

What is the reason for marking the person as outstanding and not for deletion?

We've set it up so that when the person disappears from the source system (HR) the person is marked as outstanding.

Yeah, but if it does then why not deleting it in OneIM if HR is the master. In that case, everything would work as expected even when a delete delay is configured.

You are just using the flag MarkAsOutstanding in a way it is not meant to be used.

Thanks Markus.

I've now change the action from MarkAsOutstanding to Delete. But when the appear in the source system again the XMarkedForDeletion is not changed from 1 to 0. Have I missed something? Isn't the sync going to take care of that?

problem is that there is different delay for different Persons and AD accounts. Just delete delay on table will not solve that.

Yeah but still, MarkAsOutstanding is not meant to be used to remove the assignments. So if you want to go the route with using MarkAsOutstanding, you might want to set the flag Person.IsNoInherite first which would lead to the removal of all inherited permissions to the person.

Yeah but still, MarkAsOutstanding is not meant to be used to remove the assignments. So if you want to go the route with using MarkAsOutstanding, you might want to set the flag Person.IsNoInherite first which would lead to the removal of all inherited permissions to the person.