AD Entitlement Owner not shown in entitlement page

[robin82 (Robin Stha)]

Upon completion of entitlement aggs of AD source, the entitlement owner is still missing. The owner info is present in the AD side.

The group schema also has owner attribute as follows:

My understanding has always been that the entitlement aggregation would pull up all the owner information from managedBy attribute of AD source. Is there any missing piece here or any mappings that needs to be done?

I saw similar post regarding the use of powershell script to update the entitlement owners.

AD Entitlement Owner Update

Is there a way to set AD entitlement owner in SailPoint IDN with the managedBy attribute from Active Directory? Currently in AD side, managedBy attribute is set as owner. We need to use the same to update in owner attribute in group schema. Is there any automated way to do it? Please let me know.

Can anyone guide me on the powershell approach?

[agutschow (Alicia Gutschow)]

You can get a list of entitlements using:

list-entitlements | SailPoint Developer Community

Then you can query AD to find the owner.

Finally you can patch the entitlement with the new owner.

patch-entitlement | SailPoint Developer Community

[IIQUserOnCompass (Terry Yau)]

There’s no OOTB feature to auto map / copy an AD group object’s attribute value to become an entitlement owner in ISC. It’s painful (you need to handle this out of band).

In a similar manner, there’s no automatic mechanism for you to specify the logic / source of any of the OOTB flags (e.g. Privileged, Requestable), nor any of the Metadata Attributes.

[robin82 (Robin Stha)]

This seems to be a bulk patch approach. I m skeptic this approach may not be efficient if the no of such entitlements(missing owners) are huge.

[robin82 (Robin Stha)]

Any alternate that you have implemented for it, Terry? I see a few post regarding the use of Powershell scripts but have not been able to get the know-how of that approach. I guess this actually means to pull the owner from Active Directory then go back in IDN and via api update the ownership.

Entitlement Ownership : Search and Updates

Couple of questions of entitlements in IDN - a) As per search documentation Searchable Fields - SailPoint Identity Services for entitlements , it seems that owner is not a primary searchable field , but when we just put “owner” word in search box it does prompt for id, name, type etc. When I try building a query say using owner.name:“”, so it doesn’t return anything. So wanted to understand if this is in-flight or a bug or i am doing anything wrong here. b) Is there a quick way of updating ent…

An alternate provided is for access profile and role update: https://community.sailpoint.com/t5/Professional-Services/IdentityNow-Bulk-Access-Profile-and-Role-Importer/ta-p/77382

[IIQUserOnCompass (Terry Yau)]

The Bulk Importer requires the identity name of the owner. Depends on the information available on the AD Group object, on AD, you may only have the owner DN, employee number…or something…but not necessarily the identity name of the manager / owner.

So, from a sequencing perspective, you typically would:

1. Get the group object.
2. Select the attribute value of the group object that mentions who the group owner is.
3. Do a search on ISC to see which identity that owner is.
4. Update the role / access profile / entitlement owner with that identity.

In order to use the bulk importer, you introduce a step 3.5 which is to create the CSV file. For a team coming from AD / PowerShell background, doing 1,2,3,4 is more straight forward and it gives them the learning experience / exposure to the PowerShell SDK to potentially update any of the other data points (Privileged flag, Metadata Attributes…etc).