Where each decision is made

Everything in the lifecycle is configuration. This is where each decision lives.

To change…	Go to	Setting
Who gets an account at all	Access › Business roles	Assignment Rule on a dynamic role
What kinds of account exist	Access › Account definitions	One definition per kind of account
Which kind of account a role grants	Access › Business roles	Select target resources to assign
Where accounts are created	Access › Account definitions	Where accounts are created
Whether missing containers are created	Access › Account definitions	Create the container if it does not exist
What happens when no container matches	Access › Account definitions	When nothing matches
Whether accounts follow a mover	Access › Account definitions	Move an account when the person's attribute changes
Moving existing accounts after a rule change	Access › Account definitions	Re-apply to existing accounts
Account names	Access › Account definitions	Prefix
Display names (cn)	Automation › Computed field rules	The rule for directory accounts' common name
Sign-in names (sAMAccountName)	Connectivity › Synchronisation	The user mapping
How long withdrawn accounts are kept	Access › Account definitions	When access is withdrawn
What a department grants	Identities › Organisation › Departments	Select business role to assign
What a position grants	Identities › Organisation › Employments	Business roles on the employment
What a location grants	Identities › Organisation › Locations	Business roles on the location
Which groups a role grants	Access › Business roles	Select target resources to assign
Which account a role's groups go on	Access › Business roles	Entitlements apply to
Where groups go when a role says nothing	Access › Account definitions	Primary on one definition per system
Which attributes reach a target system	Connectivity › Synchronisation	Mapping rules and their direction
When joiners are enabled	Automation › Scheduled tasks	Enable accounts on the entry date
When leavers are deactivated	Automation › Scheduled tasks	Deactivate leaving identities
When withdrawn accounts are deleted	Automation › Scheduled tasks	Purge retired accounts
Whether a status disables accounts	Identity status	Set per status — no screen yet
Whether a status also removes groups	Identity status	Set on Inactive only — no screen yet
Re-sending everything to a system	Connectivity › Plans	Push all on the provisioning plan
Retrying a failed push	Connectivity › Provisioning	Retry