# Assign a new role to existing identities in bulk

**URL:** <https://developer.sailpoint.com/discuss/t/assign-a-new-role-to-existing-identities-in-bulk/28614>\
**Category:** SHF Discussion and Questions\
**Tags:** identity-security-cloud, roles\
**Created:** [February 2, 2024, 7:39pm UTC](https://developer.sailpoint.com/discuss/t/assign-a-new-role-to-existing-identities-in-bulk/28614 "2024-02-02T19:39:11Z")\
**Posts on this page:** 12\
**Page:** 1

<div class="post-metadata">

**Author:** ![spetursson](https://avatars.discourse-cdn.com/v4/letter/s/ecc23a/32.png) [@spetursson](https://developer.sailpoint.com/discuss/u/spetursson)\
**Post date:** [February 2, 2024, 7:39pm UTC](https://developer.sailpoint.com/discuss/t/assign-a-new-role-to-existing-identities-in-bulk/28614/1 "2024-02-02T19:39:11Z")

</div>

I have created a new role that is now available in the request center. This role in turn will provide access to privileged AD accounts. These privileged AD accounts already are assigned to many old identities but of course those identities (a few hundred) do not have the new role. What is the recommended way to assign the new role to those old existing accounts in bulk?

---

<div class="post-metadata">

**Author:** ![baoussounda](https://sea1.discourse-cdn.com/sailpoint/discuss/user_avatar/developer.sailpoint.com/baoussounda/32/13095_2.png) [@baoussounda](https://developer.sailpoint.com/discuss/u/baoussounda)\
**Post date:** [February 2, 2024, 8:13pm UTC](https://developer.sailpoint.com/discuss/t/assign-a-new-role-to-existing-identities-in-bulk/28614/2 "2024-02-02T20:13:53Z")

</div>

Hi,

Is possible for you to add a membership criteria into your role ?

---

<div class="post-metadata">

**Author:** ![amishra97](https://avatars.discourse-cdn.com/v4/letter/a/50afbb/32.png) [@amishra97](https://developer.sailpoint.com/discuss/u/amishra97)\
**Post date:** [February 2, 2024, 8:17pm UTC](https://developer.sailpoint.com/discuss/t/assign-a-new-role-to-existing-identities-in-bulk/28614/3 "2024-02-02T20:17:21Z")

</div>

Hi @spetursson

You can do it like this. If an identity has the entitlement(TestGroup3 in my case) that user will automatically get the Role. If you already have assignment criteria then add this in OR condition with existing assignment rule.

 ![image](https://global.discourse-cdn.com/sailpoint/original/2X/1/1233261e54506f3dcd1bb5959a76e76ccde24871.png)

---

<div class="post-metadata">

**Author:** ![amishra97](https://avatars.discourse-cdn.com/v4/letter/a/50afbb/32.png) [@amishra97](https://developer.sailpoint.com/discuss/u/amishra97)\
**Post date:** [February 2, 2024, 8:30pm UTC](https://developer.sailpoint.com/discuss/t/assign-a-new-role-to-existing-identities-in-bulk/28614/4 "2024-02-02T20:30:07Z")

</div>

Hi @spetursson

However, because old identities will get role through assignment logic, the above approach only allows you to acknowledge the role—not approve or revoke them during access review.

 ![image](https://global.discourse-cdn.com/sailpoint/original/2X/c/cb5fdb40ec9835eb668bab683268711abab50cd8.png)

---

<div class="post-metadata">

**Author:** ![ethompson](https://sea1.discourse-cdn.com/sailpoint/discuss/user_avatar/developer.sailpoint.com/ethompson/32/17298_2.png) [@ethompson](https://developer.sailpoint.com/discuss/u/ethompson)\
**Post date:** [February 2, 2024, 8:49pm UTC](https://developer.sailpoint.com/discuss/t/assign-a-new-role-to-existing-identities-in-bulk/28614/5 "2024-02-02T20:49:16Z")

</div>

If the idea is to have the role only by request but want to bulk load existing users you can use the /v3/access-requests API to add those users to the role.

Below is part of an example PowerShell script. This could be used in combination with or without the PowerShell SDK once you know all the user’s ids.

```auto
$tenant = ""
$token = ""
$users = @()
$roleId = ""

foreach ($user in $users) {
    $body = @{
        requestedFor = @(
            $user
        )
        requestType = "GRANT_ACCESS"
        requestedItems = @(
            [PSCustomObject]@{
                type = "ROLE"
                id = $roleId
                comment = "Adding role to existing users"
            }
        )
    }
    (ConvertTo-Json $body -depth 5)

    $params = @{
        method = "POST"
        uri = "https://$($tenant).api.identitynow.com/v3/access-requests"
        body = (ConvertTo-Json $body -Depth 5)
        headers = @{Authorization = "Bearer $token" }
        ContentType = "application/json"
    }
    try {
        $response = Invoke-RestMethod @params
        $response
    }
    catch {
        Write-Host $response
        Write-Host $_.Exception.Message -ForegroundColor Red
        Write-Host $_.Exception.ItemName -ForegroundColor Red
    }
}

```

---

<div class="post-metadata">

**Author:** ![spetursson](https://avatars.discourse-cdn.com/v4/letter/s/ecc23a/32.png) [@spetursson](https://developer.sailpoint.com/discuss/u/spetursson)\
**Post date:** [February 2, 2024, 8:58pm UTC](https://developer.sailpoint.com/discuss/t/assign-a-new-role-to-existing-identities-in-bulk/28614/6 "2024-02-02T20:58:44Z")

</div>

Good point. That should work.

---

<div class="post-metadata">

**Author:** ![spetursson](https://avatars.discourse-cdn.com/v4/letter/s/ecc23a/32.png) [@spetursson](https://developer.sailpoint.com/discuss/u/spetursson)\
**Post date:** [February 2, 2024, 9:00pm UTC](https://developer.sailpoint.com/discuss/t/assign-a-new-role-to-existing-identities-in-bulk/28614/7 "2024-02-02T21:00:22Z")

</div>

That’s a bit unfortunate. Being able to revoke those later down the road is one of the main reasons for why I am trying to bring those old identities into the role.

---

<div class="post-metadata">

**Author:** ![spetursson](https://avatars.discourse-cdn.com/v4/letter/s/ecc23a/32.png) [@spetursson](https://developer.sailpoint.com/discuss/u/spetursson)\
**Post date:** [February 2, 2024, 9:03pm UTC](https://developer.sailpoint.com/discuss/t/assign-a-new-role-to-existing-identities-in-bulk/28614/8 "2024-02-02T21:03:49Z")

</div>

Great, I was hoping there was API for this. Will this approach allow for those roles to be revoked later or will they be limited to only “acknowledge” only?

---

<div class="post-metadata">

**Author:** ![amishra97](https://avatars.discourse-cdn.com/v4/letter/a/50afbb/32.png) [@amishra97](https://developer.sailpoint.com/discuss/u/amishra97)\
**Post date:** [February 2, 2024, 9:14pm UTC](https://developer.sailpoint.com/discuss/t/assign-a-new-role-to-existing-identities-in-bulk/28614/9 "2024-02-02T21:14:04Z")

</div>

Hi @spetursson

I thought so & I also won’t advise using an assignment strategy in this particular situation because these users didn’t get the access through assignment.

The above solution from @ethompson will work because he is using access request API. You can revoke or approve the roles granted through access request during certification.

---

<div class="post-metadata">

**Author:** ![spetursson](https://avatars.discourse-cdn.com/v4/letter/s/ecc23a/32.png) [@spetursson](https://developer.sailpoint.com/discuss/u/spetursson)\
**Post date:** [February 2, 2024, 9:27pm UTC](https://developer.sailpoint.com/discuss/t/assign-a-new-role-to-existing-identities-in-bulk/28614/10 "2024-02-02T21:27:11Z")

</div>

Thank you. I will focus on the API approach then.

---

<div class="post-metadata">

**Author:** ![Sivakrishna1993](https://sea1.discourse-cdn.com/sailpoint/discuss/user_avatar/developer.sailpoint.com/sivakrishna1993/32/25424_2.png) [@Sivakrishna1993](https://developer.sailpoint.com/discuss/u/Sivakrishna1993)\
**Post date:** [February 9, 2024, 8:41am UTC](https://developer.sailpoint.com/discuss/t/assign-a-new-role-to-existing-identities-in-bulk/28614/11 "2024-02-09T08:41:59Z")

</div>

Hi @spetursson,

If users already have AD account before onboard them into SailPoint then if you try to add role to those users then you will get errors saying that “ **object already exists** ”.  
So, Better to avoid adding roles for already existing AD accounts.

Thanks,  
Siva.K

---

<div class="post-metadata">

**Author:** ![system](https://global.discourse-cdn.com/sailpoint/original/2X/f/f2136700ed5e3703e0b85e02f6be799dacca7735.png) [@system](https://developer.sailpoint.com/discuss/u/system)\
**Post date:** [April 9, 2024, 8:42am UTC](https://developer.sailpoint.com/discuss/t/assign-a-new-role-to-existing-identities-in-bulk/28614/12 "2024-04-09T08:42:53Z")

</div>

This topic was automatically closed 60 days after the last reply. New replies are no longer allowed.