AD entitlement Audit

Identity Security Cloud (ISC) ISC Discussion and Questions
,
1

Hi,

I have entitlements in AD and have daily aggregation to SailPoint ISC. We have SNOW for access request so users are added to AD groups from SNOW. Since we have daily aggregation, entitlements gets updated with new user access. How can we get the audit of the entitlements like which users are added and revoked access to the AD group in SailPoint ISC?
I see that Events are not captured in SailPoint since SailPoint didn’t provision or revoke access. And Access history shows for each user and not all the users for the entitlement. How can i get the audit history for the entitlement.

2

You can try with the workflows:
Native Change Account Updated | SailPoint Developer Community

2 Likes
3

Thanks for the link. This is for any account update or attribute updates. I’m looking for entitlement updates. That too for any specific entitlement. Even if we configure Native update for AD source, we will have lot of triggers since AD account gets updated more frequently with access.

4

And the entitlements assigned to accounts are an account attribute. When you add an account to a group in AD, the memberOf attribute on the account changes.

You can trigger native change events based on the memberOf attribute being changed

1 Like
5

Hey, another option if you want to be granular with what your auditing may be to create a provisioning completed trigger setup like:

  1. Trigger: Provisioning Completed
    Filter: $.accountRequests[?(@.provisioningResult == ‘committed’ && @.provisioningTarget == ‘Active Directory’)]

  2. Compare Strings: Check if Modify Operation

    • Value1: $.trigger.accountRequests[0].accountOperation
    • Operator: Equals
    • Value2: Modify

  3. If Modify = True:
    a. Verify Data Type: Check for memberOf Add
    JSONPath: $.trigger.accountRequests[0].attributeRequests[?(@.operation == ‘Add’ && @.attributeName == ‘memberOf’)]

    b. Get Variable: Extract the group name (if found)
    JSONPath: $.trigger.accountRequests[0].attributeRequests[?(@.operation == ‘Add’ && @.attributeName == ‘memberOf’)].attributeValue

I have never had a chance to try using a nested attribute within the provisioning completed trigger but could be worth a look!

1 Like
6

Wouldn’t this just extract the groups that ISC is adding the user to? OP is trying to find provisioning action outside of ISC.

7

This topic was automatically closed 60 days after the last reply. New replies are no longer allowed.