Disabling a fully managed account without disabling the Person

Speaking generally, the ability to request items from the IT Shop is not related to the user account being fully managed.

The question is, if all user accounts of this target system should be allowed to be disabled or just some user accounts.

Again, speaking generally, create a custom manage level that doesn't switch the accountdisabled flag based on the state of the person. Assign this manage level to the account in question.

Speaking generally, the ability to request items from the IT Shop is not related to the user account being fully managed.

The question is, if all user accounts of this target system should be allowed to be disabled or just some user accounts.

Again, speaking generally, create a custom manage level that doesn't switch the accountdisabled flag based on the state of the person. Assign this manage level to the account in question.

Hi Markus,

What I have noticed that people can request products on IT shop successfully but end entitlements are not granted to the account unless account has manage level which has "inherit groups" checked which ultimately "fully managed" account def has.

Coming back to the questions, yes! I do want that all accounts should be allowed to disable from target system.

Best regards,

Daniel

The assignment of the "inherit groups" flag is controlled by something called IT operating data in OneIM and this can be set by the manage level yes. But it doesn't have to be the manage level "fully managed" but can be set by custom ones as well.  You will find more on this topic in the documentation. https://support.oneidentity.com/technical-documents/identity-manager/8.1.1/target-system-base-module-administration-guide/2

In your case, you need to create a custom manage level, that hasn't checked the flags for the automatic disabling of the account.