IdStory Identity Manager

Now doesn't exist simple workaround that process excluded users :( only project specific LRT

Lookout: Excluded users = Inactive users (see #1724). Are you sure, you want to notify inactive users?

The LRT won't process "manually disabled" or "left" or any "disabled" identities too. Funny thing is that the LRT processes them after they are switched back to "valid" state. The disabled identities are not present in the queue of the LRT. This might cause situations where an employee quits a job in organization and is rehired later (e.g. after few years) or returns after "exclusion", her/his identity is enabled by sync of HR system and HR processes and after that she/he receives a notification about password expiration.

I would be very careful when implementing this change because after deploying it CzechIdM might send a lot of unwanted notifications. There will be plenty of disabled identities with expired password which are not present in the LRT's queue.

Also I don't think it's a good idea to notify disabled users. I understand your need to do the provisioning on the account regardless of the identity state.