Alert IAM Admin on Provisioning Failures Due to Outdated Roles (Deleted/Renamed Groups in AD)

[SuryaTejaD (Surya Teja)]

In our current setup(v8.3p4), we are facing a challenge where provisioning or deprovisioning processes fail when an assigned Role contains outdated groups that have either been renamed or deleted in Active Directory (AD). Since these changes are not automatically reflected in SailPoint Bundles, the affected Roles become invalid, leading to provisioning failures.

We want to explore the best approach to alert the IAM administrators when such a failure occurs so they can take immediate action to update the affected Roles. Alternatively, is there any configuration or feature that allows Roles to automatically update when a group is renamed or removed in AD?

Our key requirements:

1. Get alerts/notifications when a group referenced in a Role is renamed or deleted in AD.
2. Prevent provisioning failures by ensuring Roles stay updated with group changes in AD.
3. Explore any possible automated updates to Roles when changes occur in AD.

Has anyone implemented a similar solution? Are there best practices or configuration options in SailPoint that can help address this issue?

[abartkowski (Adam Bartkowski)]

Hi @SuryaTejaD

For this kind of issues you can configure in IIQ NAtive Change Detection:

Native Change Detection Configuration

Managing Native Change Detection - SailPoint Identity Services

Best regards

[abartkowski (Adam Bartkowski)]

I have find out also similar article that describes some configuration stuff regarding native change detection:

Native Change Detection in Active Directory Source

Thanks @kwhipple and @chirag_patel for the responses. I have one more requirement where we need to generate a report of the exact native changes that has happened on the account. This is for other types of sources. Now from search we can query for different operations, specific source etc. name:“Native Change Detected” AND attributes.sourceName.exact:“” What I am looking at the exact details of the change that has happened. Like the exact entitlement change or non-entitlement attribute chan…

[SuryaTejaD (Surya Teja)]

Thank you for your response!

I have gone through the article on Native Change Detection and tried replicating it in our lower environment. I made a change to an AD group and then ran an aggregation, but I did not observe any updates in the Role where this group is associated. Additionally, no changes were reflected in the user’s Identity Cube, even after running a refresh task.

Could you clarify if there are any additional configurations required for the Role to detect and update changes from AD? Or should this be handled through a different approach?

Looking forward to your insights!