Isolate and Disconnect

Operator runbook for two interventions on a single connector object: Isolate freezes it so nothing flows in or out until you release it, and Disconnect breaks its link to a mesh object so the account no longer belongs to that person.

When to reach for each

• Isolate when something is wrong with one account and you want IdentityMesh to stop touching it while you investigate. A bad source record, a contested account or a half-finished manual fix are typical. Nothing is lost and nothing is unlinked.
• Disconnect when the account is linked to the wrong person, or when a person has left and the account must stop being theirs. The connector object stays where it is, but it is no longer tied to that mesh object.

Where to find them

• On a mesh object, open the Connector Objects tab and use the actions on a row.
• On a connector, open MS Objects and use the actions on a row.

Both places offer the same actions and record the same audit entry.

Isolate

An isolated connector object is frozen in both directions until someone releases it.

• Nothing is imported from it. The row still appears in imports, so it is never treated as missing and never marked deleted, but its stored data stays exactly as it was.
• Nothing is exported to it. Pending changes for that account are held back and show as Held in the export queue.
• It applies to the whole person on that connector. Isolation is set per connector object, but isolating any row freezes every row that person has on that connector.

Releasing

Choose Release on the row. Release is quiet by default: the next scheduled import and export pick the object up again. Tick Import now to pull the object’s real state from the connected system immediately, which is the better choice when the account changed while it was frozen.

Disconnect

Disconnect breaks the link between the connector object and the mesh object. The connector object becomes an orphan, which the join rules can pick up again once you release the hold or if you skipped it.

By default Disconnect also places an export hold on that connector for that mesh object. While the hold is open:

• No replacement account is provisioned for that person on that connector.
• Exports to that connector for that person are held.
• Imports will not link that connector’s accounts to that mesh object. A full import does not re-link the account while the hold is open.

The hold is undone only by releasing it. Open the mesh object, find the Held exports list and choose Release hold. That is the explicit “yes, provision if the rules say so” step. After that, the join rules and the export rules behave normally again.

Allow re-provisioning (no hold)

The Allow re-provisioning (no hold) checkbox skips the hold. Use it only when a fresh account is the point, for example when you disconnect a stale account so the person can get a new one. Without the hold:

• The next import re-links the account to whoever the join rules say, which can be the same person again.
• Exports can create a new account if the rules call for one.

Where status shows

• A State column on both lists: Active, Isolated or Deleted.
• A Held exports list on the mesh object.
• An amber strip in the mesh object header when it has an isolated row or an open hold.
• Isolated and Held entries in Preview Export.
• A Held status in the export queue.
• Isolated counts on the connector’s MS Objects badge, for example “2359, 1205 deleted, 3 isolated”.
• An Isolated / Held column on the Operations page, shown when any connector has either.

Permission

All of these actions need the ms.write permission. Admin and Operator hold it by default.

Audit trail

Every action records who, when and why. The entry appears in the admin audit trail and on the mesh object’s Audit tab. For how long the admin audit trail is kept, see audit-retention.md.

Deleting a connector’s management space data

Wiping a connector’s management space data would discard isolation and holds along with everything else. IdentityMesh therefore refuses when the connector has isolated rows or open holds, until you confirm by typing the connector’s name.

Which one do I want?

Upgrading an existing installation

Follow the normal upgrade procedure in upgrades. The MSI’s database step applies the schema changes this feature needs, so there is nothing extra to do.

Related

• admin-ui.md — the console.
• reconciliation.md — connector counts and drift.
• authentication.md — roles and permissions.