I just came across a scenario where I have a person with accounts on many custom target systems (UNSAccountB). All accounts are fully managed accounts (they inherit accountdisabled check from Person). Now there is a requirement to disable some accounts which are linked with the person as fully managed accounts. Currently, I cannot disable account from Manager tool due to Manage level of the account.
Also, target system administrator disable accounts on his side and I can see in sync editor logs that 1IDM try to disable these accounts at the time of sync but it cannot due to fully managed behavior.
Is there a way to achieve this while keeping the fully managed behavior as well?
on side note: users request entitlements for these accounts from IT shop, this also one of the reason to keep the fully managed behavior.