Yes, the search syntax @accounts( source.name:"AD" AND state:"disabled" ) is correct for finding identities with disabled AD accounts. In this case, the query filters accounts based on the state being
"disabled," which is valid and effective for identifying disabled accounts.
Key Reference from SailPoint Documentation:
* Search by Account State: Using state:"disabled" is an accurate way to search for disabled accounts in SailPoint IdentityNow.