Safe decommissioning of a legacy Dynamic Endpoint with correlated accounts in Production

Products

• CA Identity Suite
• CA Identity Manager

Issue/Introduction

A production environment requires the complete removal of a legacy Dynamic Endpoint. The endpoint has remained unused for a long time.No Explore correlate activity was executed on the endpoint lately.

Deleting the endpoint directly without preparation risks performance degradation, timeouts, or excessive system load due to the volume of account and inclusion deletions.

Environment

• Symantec Identity Manager 14.5, v15

Resolution

Follow a multi-step batch approach to minimize risk and maintain system performance.

1. Access the endpoint configuration and update settings to: "Accounts will be deleted from the provisioning directory, but left unchanged on the managed endpoint." This prevents unnecessary communication attempts with endpoint.
2. Log in to the Identity Manager Management Console.
3. Temporarily disable some inbound notifications like: 
   assign unassign provisoning role, delete user, modify provisioning role, modify user, remove account template from provisoning role, remove endpoint from account template, update global user
   to reduce traffic between the Provisioning Server (IMPS) and Identity Manager (IMS) during the cleanup.
4. Identify the Provisioning Roles associated with the legacy endpoint.
5. Remove Provisioning Role memberships from users in batches (e.g., 1000 to 2000 users per batch) using etautil or the User Console.
6. Verify that inclusions and endpoint accounts successfully decrement after each batch.
7. Delete the associated Account Templates and any related Policy Xpress policies once account counts reach zero.
8. Perform the final deletion of the endpoint object from the Provisioning Manager.
9. Re-enable the inbound notifications disabled in step 3.