When a role is assigned to multiple accounts of single identity from same source, the certification view shows the role twice for that identity but omits account details. I’ve attached screenshots of both the identity view and the access-item view. Updating the public identity configuration to display additional identity attributes does not resolve this issue, because the source account name (native identity) is not stored as an identity attribute.
Access item certification displays duplicate role entries for the same identity without showing source account details.
Is there any workaround to make account details visible in certification?
PS: We have roles which contain accesses from single source only. We can’t use access profile instead because it doesn’t allow us multiple assignment on 2 accounts of single identity.
Hello Dhaval. I think this is a limitation in the current certification view.
ISC keeps the target account on each Role assignment, and that information is available through the Role Assignment API in accountTargets. However, the certification Role model does not expose that assignment-level account information.
That is why Public Identity Configuration does not help here, since it only adds identity attributes to the certification details.
You could use the Role Assignment API for supplemental reporting, but there is no documented way to reliably map those account targets back to each duplicate Role row in the certification.
If the account needs to be shown directly in the certification, I would suggest opening a SailPoint Support case or submitting an enhancement request.
Currently, there is no standard workaround in ISC Access Item Certifications to display the source account details (native identity) for duplicated role entries. Certification campaigns are identity-centric, and when the same role is granted across multiple accounts from the same source, the role may appear multiple times without exposing the underlying account information. Since native identity is not stored as an identity attribute, adding attributes to the Public Identity Configuration will not help. The recommended approach is to raise an enhancement request with SailPoint Support/Product Management or consider using an Identity Certification instead, where account-level details may provide better visibility depending on the certification design.
Thank you for your response. Report doesn’t help much either since decision has to be made in certification!
Yes i have already opened enhancement idea for this: https://ideas.sailpoint.com/ideas/GOV-I-5374
