Any *actual* good ways for entitlement self-revocation or non-sticky entitlements?

Does anybody have any GOOD ways to either allow users to self-revoke entitlements or make entitlements NOT ‘sticky’ to a source?

As many others have posted before me, the simple fact is sometimes application owners need to change data/permissions on the target application for whatever reason. Or, a user is done with a certain function and no longer needs access to dataset or entitlement, but needs a new one to replace it. This doesn’t necessarily mean a team or manager change in the authoratative source. Entitlements via Access Requests are ‘sticky’ - so if the owner removes the role/entitlement on the target side, Sailpoint will add it back on next aggregation. So - how do we get around this? The list of options or discussions I’ve seen across various posts are below. In my opinion none of them are good (or don’t exist). So does anyone have any GOOD methods to get around this? What is YOUR company doing about it?

  • Self-Service: Self-Revocation would at least help, but as we know there is no self-service revocation feature (which is insane). At least we could rely on best-effort from the user and catch outliers with a campaign periodically. There’s been an idea open for years with hundreds of votes but no action.

  • Forms: Well, I suppose we could fill the feature gap of no self-service with forms, IF you could put a form right on the dashboard for end-users. The idea of trigging an external source to kick off a workflow to THEN assign a form to an end user (and then another workflow to act on that form) is ridiculous. That’s not a ‘good’ solution at all. I would also like to say if we can handle self-service revocation via a form there is no excuse for this not to be built-in to Sailpoint. None at all.

  • ISC Admin Revoke via Entitlements page: Not a good solution, end users don’t know who to reach out to for this, nor should they. In most cases they would reach out to the target app owner (who then has to reach out to an ISC admin). This is wasteful and too manual of a process.

  • Access Profiles vs. Entitlements: I understand that Access Profiles are not ‘sticky’, so one option is replace all the Entitlements with a one-to-one relationship with a new Access Profile and stick them in there. Again - this is a possibility but not ‘good’ as it would require us to re-structure our entitlement/access request design over again. Additionally I think managers can remove access from their employees IF they are Access Profiles (not entitlements) right?

  • Connector Setting: I haven’t heard of such a thing but why the devil could this not be a per-connector setting, to enable ‘sticky’ entitlements or not? Just have some setting that doesn’t write entitlements back to the source on aggregation operations (only for create-account and add-entitlement).

  • Source Sub-Admins: Well I got excited for a second because it looked like if I gave the app owner the Source Sub-admin user level AND made the source itself managed by a governance group, that they would be able to search through Entitlements → View Identities → Revoke that way (like an ISC admin would). But…when he tried, nothing happened. It gave him the ‘success’ message like his revocation processed, but there are no events or activity in log, nothing. Also it appeared he could revoke entitlements for any other source too (well, if it worked, that is). Is that by design?

  • Delegation: I’m aware of some 2025-ish idea to delegate admin levels more granularly - maybe that would be an option similar to my above attempt at Source Sub-Admins - but that’s 2025 (and who knows what quarter).

Any other possibilities I am missing here?

1 Like

We use Access Profiles, and mainly rely on Managers to revoke access when not needed. Would love to see an option for self-revocation directly in the Request Center.

There is one work around that can be done with Access Profiles and Requestable Roles (I believe it can be done with Entitlements too, but haven’t tried it). Have the user re-request the access in the Request Center, but use Set Expiration during the request process. They can choose the next day (or any date in the future), and then the access will be removed on the date set in the request.

I just had to deal with the same situation with roles and the option we decided to go with and thought was easier to implement was to run a targeted certification campaign to revoke those requested items.

Yeah that was one option I offered the app owner - to either frequently schedule a campaign or they just tell me when to fire one off. They didn’t like the idea though.

1 Like

Hi @SailorKev ,

In addition, you can use workflows to revoke access based on the triggers.
Another option is, if it is an AD group, you can create PowerShell script and use Revoke Access API to revoke the access.

Thanks,
Favaz

@mohammedfavazhrb Can you elaborate on “revoke access based on the triggers.”? What kind of logistical workflow are you thinking of? For a minute this morning I thought about somehow utilizing a native change detection workflow that looks at the previous/old value that was changed from, and submitted a revoke action for the previous value (in the case of the source entitlement having to change) but that seems clunky and after-the-fact; I’m not even sure if it was feasibly work.

I think this discussion would be worth reviewing:
https://community.sailpoint.com/t5/IdentityNow-Forum/IdentityNow-Mock-Project-Services-Standard-BeforeProvisioning/td-p/216158

Thanks,
Aman

Hi @SailorKev,

Below discussions will be a good reference.

This topic was automatically closed 60 days after the last reply. New replies are no longer allowed.