ADSAccount deleted and not only deactivated.

Question

Hello, 
 
 I have OIM9.1 and we set ADSAccount definition with all the following options set : 
 
 Retain account definition if permanently disabled 
 Retain account definition if temporarily disabled 
 Retain account definition on deferred deletion 
 Retain account definition on security risk 
 
 I have encountered this case and i don t understand why this behaviour or if it s normal :

I create manualy an employee account, manualy assign a business role that implies an ADSAccount, so OIM give it an ADSAccount

I remove the business role manualy , the ADSAccount is deleted..!!

i don t undesratnd why account is deleted and not only deactivated.. 
 
 For accounts created by synchronisation, ASDAccount is deactivated.. 
 
 What is want for ADSAccount is to be deactivated then deleted after 30 days of quarantine 
 
 How to set up this.. 
 
 Thank you fo helping 
 
 I want to only deactivate it, then after 30 days (quarantine), OIM deletes it..

Troy Grandy · Answer

You have removed the source of inheritance so this will remove the account definition, the user was only getting this because they belonged to the business role. This is expected.

Endpoint Privilege Management

ADSAccount deleted and not only deactivated.