<div style="font-family: Arial, sans-serif; font-size: 14px;">Hi Yakov,</div><div style="font-family: Arial, sans-serif; font-size: 14px;"><br></div><div style="font-family: Arial, sans-serif; font-size: 14px;">Thanks for this suggestion, I will look into it/do some tests.</div><div style="font-family: Arial, sans-serif; font-size: 14px;"><br></div><div style="font-family: Arial, sans-serif; font-size: 14px;">Kind regards,</div>
<div style="font-family: Arial, sans-serif; font-size: 14px;" class="protonmail_signature_block">
<div class="protonmail_signature_block-user">
Markus </div></div><div class="protonmail_quote">
On Thursday, 25 September 2025 at 07:16, Yakov Revyakin <yrevyakin@gmail.com> wrote:<br>
<blockquote class="protonmail_quote" type="cite">
<div dir="ltr">You know that a user is active if administrativeStatus is unknown. Let the HR resource leave administrativeStatus unknown for an active user, set administrativeStatus with Disable using standard Midpoint activation UI. In this case, HR still skips setting administrativeStatus explicitly and your hand made administrativeStatus won't be overwritten after reconciliation. If you'd like to make the user enabled again you simply set administrativeStatus in Unknown back. This delegates management for administrativeStatus to HR back again. <div><br></div><div>You can add a condition in the HR resource status attribute to limit status calculation only by Disable case.</div><div><br></div></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Fri, 19 Sept 2025 at 10:20, Markus Calmius <<a href="mailto:markus.calmius@proton.ch" target="_blank" rel="noreferrer nofollow noopener">markus.calmius@proton.ch</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div style="font-family:Arial,sans-serif;font-size:14px">Yes, HR is source of truth.</div><div style="font-family:Arial,sans-serif;font-size:14px">However, sometimes a forced offboarding or onboarding can take place. Then we have an override status, based on this: <span><a rel="noreferrer nofollow noopener" href="https://evolveum.com/how-to-override-administrative-status/" target="_blank">https://evolveum.com/how-to-override-administrative-status/</a></span></div><div style="font-family:Arial,sans-serif;font-size:14px"><br></div><div style="font-family:Arial,sans-serif;font-size:14px">So we do have a way to do it, but the default buttons are not the way</div><div style="font-family:Arial,sans-serif;font-size:14px"><br></div>
<div style="font-family:Arial,sans-serif;font-size:14px">
<div>
Markus</div></div><div>
On Thursday, 18 September 2025 at 16:34, Yakov Revyakin <<a href="mailto:yrevyakin@gmail.com" target="_blank" rel="noreferrer nofollow noopener">yrevyakin@gmail.com</a>> wrote:<br>
<blockquote type="cite">
<div dir="ltr">Do you mean sync with HR overrides Midpoint user's administrative status which Midpoint admin changed before?</div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Mon, 15 Sept 2025 at 17:35, Markus Calmius via midPoint <<a href="mailto:midpoint@lists.evolveum.com" rel="noreferrer nofollow noopener" target="_blank">midpoint@lists.evolveum.com</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div style="font-family:Arial,sans-serif;font-size:14px"><br></div><div style="font-family:Arial,sans-serif;font-size:14px">Hi,</div><div style="font-family:Arial,sans-serif;font-size:14px"><br></div><div style="font-family:Arial,sans-serif;font-size:14px">TL;DR</div><div style="font-family:Arial,sans-serif;font-size:14px">is it possible to either:</div><div style="font-family:Arial,sans-serif;font-size:14px"><ol style="margin-top:0px;margin-bottom:0px"><li style="list-style-type:"a) ""><span> hide the buttons for enable/disable users, or<br></span></li><li style="list-style-type:"b) ""><span>override the default action?</span></li></ol><div><span><br></span></div><div>To give some more background:</div><div></div><span>Our HR system is the sole authority for creating user accounts and assigning their administrative status.</span><div><br></div><div><span>We have implemented an override mechanism that allows us to deactivate a user ahead of the HR‑initiated process when necessary.</span></div><div><br></div><div><span>While the standard deactivation buttons function correctly, the change is only temporary. Any update to the user or the execution of the HR‑reconciliation task restores the status defined by HR.</span></div><div>Although we could restrict this capability entirely. it will result in an error message. I prefer to prevent the action silently rather than generate errors.</div><div>For example, a service‑desk technician who is authorised to disable accounts may use the default buttons and assume the operation succeeded. In reality, the modification is later undone by the HR reconciliation process.</div><div><br></div><span></span><div><span><br></span></div><div><span>Kind regards,</span></div></div>
<div style="font-family:Arial,sans-serif;font-size:14px">
<div>
Markus</div>
<div>
</div>
</div>
_______________________________________________<br>
midPoint mailing list<br>
<a href="mailto:midPoint@lists.evolveum.com" rel="noreferrer nofollow noopener" target="_blank">midPoint@lists.evolveum.com</a><br>
<a href="https://lists.evolveum.com/mailman/listinfo/midpoint" rel="noreferrer nofollow noopener" target="_blank">https://lists.evolveum.com/mailman/listinfo/midpoint</a><br>
</blockquote></div>
</blockquote><br>
</div></blockquote></div>
</blockquote><br>
</div>