AD Birthright group

Identity Security Cloud (ISC) ISC Discussion and Questions
5

@TJ1331 This is a common use case, you can follow the below steps.

  1. Build Lifecyclestate: Calculate the Life Cycle State as “prehire” to provisioning your account before the actual start date and “active“ to assign other AD groups on actual start date. You can refer the base transform in this post Building Life Cycle States using Transforms - Identity Security Cloud (ISC) / ISC Community Knowledge Base - SailPoint Developer Community and build on top of it.
  2. Configure the LCS in Identity Profile, refer Setting Up Lifecycle States - SailPoint Identity Services
  3. Provisioning Policy: Build a CREATE provisioning policy in your AD source with minimal required attributes by following Provisioning Policy.
  4. Role Definition for Prehire: Create a role to initiate the AD account provisioning when LCS is prehire. This role can be either requestable or birthright based on your requirement with LCS = prehire as one of role criteria and a dummy AD group can be attached to the role.
  5. Role Definition for active: Create another role and add LCS as part of role criteria along with other criteria to make it as birth right role and attach all the required accesses (AD groups) to the Role to provisioning.

Hope this helps.

2 Likes