Adding 'Matrix Manager' into Workday and ISC

Identity Security Cloud (ISC) ISC Discussion and Questions
1

Hi Team,

I am investigating if there’s any way that MS Teams, Outlook etc could reflect/show the dotted line manager instead of the regular manager for a few users.

In Workday (authoritative source), we added another field called ‘Matrix Manager’ whilst keeping the regular manager field.

Questions around this;

  1. Can we integrate this change to ISC after making the required changes in the Workday connector (XPath Schema Mapping) so those few users can now report to the Matrix manager, whilst keeping a dotted line back to their regular/previous manager?

  2. Is this achievable? If yes, how should we implement this?

  3. Do we need to create a custom identity attribute in the identity profile for this so SailPoint can sync this change to AD and then AAD?

  4. Would this affect other users’ attributes or cause any issues?

Please advise!

Thanks

2

You can just pull in this ‘Matrix Manager’ as additional account attribute.
Then you have a lot of options…
Map it to a regular Identity Attribute and push the value of that attribute to AD/Entra manager field so the manager there is updated.
Or you could also reflect it in ISC with a manager correlation rule, so that the Matrix Manager also does approvals/… and in that rule have some kind of fallback to the regular manager.
Or a combination of both…
Really it depends on your use case, to me it seems like a very basic thing to implement.

3

@tysremi Thanks for the update. Appreciated!

Under one identity profile for all users, the Workday account attribute (manager) is already mapped to the regular identity attribute (manager) which pushes the value to AD/Entra manager field.

The use case is, we want to pull in their Matrix Manager (previous manager) as additional account attribute, map it to another identity attribute and then push the value to AD/Entra manager field but only for 10/15 users. In other words, In Workday & ISC we want to set manager to be their regular manager who does approvals etc, but in AD which then sync to Entra, we want to set manager to be their Matrix manager (previous manager).

In AD source > under ‘Create Account’ profile > the AD account attribute (manager) is already mapped to their regular identity attribute (manager). We can’t change this to another identity attribute as this would affect all users.

Thanks

4

Best option in that case:
Create another IdentityAttribute with a firstValid transform in the mapping where you take the matrix manager if it exists and the regular manager as fall-back if it doesn’t (or any other transform for whatever your specific logic for those 10-15 users is), then populate that attribute in the create schema.
Advantage of this approach is that AttributeSync can be turned on for that attribute.

1 Like