[Please insert images here, otherwise delete this section]
Please share any other relevant files that may be required (for example, logs).
Share all details about your problem, including any error messages you may have received.
We are working through implementing our first certification. We are struggling with the review of our IT roles that are assigned. We have explained to the certifiers that if any entitlement within the IT role has to be revoked, the entire IT role would need to be removed and the remaining entitlements within the IT role would need to be requested. I am curious if anyone on this forum could provide any guidance on how they handle certifications that include IT roles and if the certifier wants to remove just one entitlement for the user. We have considered introducing a third reviewer which would be the security team to review the certification before system revocation so that we can handle granting the remaining entitlements that were part of the IT role. The image shared is an example of the existing certification, the certifier wants to remove the ClaimCenter role: Recovery from the user. If they select Revoke, it will remove the entire IT role and all entitlements. The user will then be removed out of the system.
This is a common issue that almost every organization faces during their first certification wave. You have a few ways to handle it:
Role Redesign : Pull Recovery out of the IT role definition entirely so it is never bundled with Adjuster/Copart User again. This removes the risk of partial revocation because Recovery becomes a standalone entitlement.
Reconfigure the certification to explode the role into individual entitlements at generation time, so the certifier can revoke Recovery on its own without a role redesign. Caveat: the person is still assigned to the IT role underneath, so a later aggregation cycle can silently re-grant Recovery unless you also handle the role assignment.
Before changing the role model, I would test an individual Revoke on the ClaimCenter role. In IIQ 8.4, if the included required or permitted roles are not used by another role for that identity, IIQ can show a dialog where you can revoke only Recovery and retain Adjuster and Copart User. Bulk revoke does not provide this behavior. Revoke or Edit Access
I would also confirm whether Recovery is required or permitted. If it is required, Identity Refresh can provision the missing access again because the parent role still requires it. If Recovery should remain under ClaimCenter but be optional per user, making it permitted may fit better, since the parent role would no longer drive its provisioning. The tradeoff is that new ClaimCenter users would no longer receive Recovery automatically, so it would need to be granted separately. Role Management Concepts
@sonia_mcdonald So purpose of Roles is to group multiple entitlements together that can be assigned or removed together. In case you don’t want it, you need to break your role modelling and let user request for entitlements only. Other way is to mark all these as Permitted roles and where they are still part of business roles but not all IT roles will be assigned to the user.. they need to request manually or have some other automation to assign selective access from the Permitted roles. Reference: Role Management in IdentityIQ - Compass. Check section :“Hard and Soft Permitted Roles”
