Hi Pradeep
Your suggestion has helped quite a bit, thanks a lot.
One other issue I seem to have is when I add a privilege P1 to a BR B1 the users assigned to that BR B1 are provisioned with P1 in the backend SAP system. So that works fine.
However, when I remove the privilege P1 from BR B1 the "reconcile role members" job runs, the role UI and user UI gets updated with the change but the privilege P1 does not get removed from the user in the backend SAP system. When I query the "idmv_link_ext_active" table as you advised earlier P1 shows up in mcorphan with 1.
What is the reason for this and how can I fix it so that when a privilege is removed from a role in IdM it actually pushes that change to the users in the backend SAP system and removes the privilege?
Please advise.
Thanks
Ranjit