Assign offboarding grousp to disabled AD account.

Did you try to work with the override for inheritance settings as described in this thread? 

www.oneidentity.com/.../keep-group-membership-after-termination

Thanks Markus for the reply.

Yes, I tried to use this functionality but it's still not working. This is the way I configured for the override inheritance settins for the groups we want to assign directly on AD:
"Retain group if temporary disabled: According to manager level
Retain group if permanently disabled: According to manager level
Retain group on defferred deletion: According to manager level
Retain group on security risk: According to manager level
Retain group if user account disabled: Always"

and in the account definition full managed we checked the box "Retain groups if user account disabled".

With this configuration when the account is disabled the groups are assigned with XIsInEffect = 1, Even before the account is being disabled the behavior is the same.

You need to assign the business role for the disabled groups via a dynamic role with the condition that the person is inactive. 

Yes Markus, it's already like this. I have two business role:
- One with the AD account definition with a dynamic rule that if a person is active is assigned.
- The other one (with the groups) that is assigned when a person with an AD account becomes inactive.

Yes Markus, it's already like this. I have two business role:
- One with the AD account definition with a dynamic rule that if a person is active is assigned.
- The other one (with the groups) that is assigned when a person with an AD account becomes inactive.