I have created a new role that is now available in the request center. This role in turn will provide access to privileged AD accounts. These privileged AD accounts already are assigned to many old identities but of course those identities (a few hundred) do not have the new role. What is the recomm…

If the idea is to have the role only by request but want to bulk load existing users you can use the /v3/access-requests API to add those users to the role. Below is part of an example PowerShell script. This could be used in combination with or without the PowerShell SDK once you know all the user…

Hi, Is possible for you to add a membership criteria into your role ?

Hi @spetursson You can do it like this. If an identity has the entitlement(TestGroup3 in my case) that user will automatically get the Role. If you already have assignment criteria then add this in OR condition with existing assignment rule. [image]

Hi @spetursson However, because old identities will get role through assignment logic, the above approach only allows you to acknowledge the role—not approve or revoke them during access review. [image]

That’s a bit unfortunate. Being able to revoke those later down the road is one of the main reasons for why I am trying to bring those old identities into the role.

Great, I was hoping there was API for this. Will this approach allow for those roles to be revoked later or will they be limited to only “acknowledge” only?

Hi @spetursson I thought so & I also won’t advise using an assignment strategy in this particular situation because these users didn’t get the access through assignment. The above solution from @ethompson will work because he is using access request API. You can revoke or approve the roles granted…

Hi @spetursson , If users already have AD account before onboard them into SailPoint then if you try to add role to those users then you will get errors saying that “object already exists”. So, Better to avoid adding roles for already existing AD accounts. Thanks, Siva.K

Assign a new role to existing identities in bulk

Identity Security Cloud (ISC) ISC Discussion and Questions

spetursson (Sig Petursson) February 2, 2024, 9:27pm 10

Thank you. I will focus on the API approach then.

Topic		Replies	Views
Bulk role assignments and select account via api ISC Discussion and Questions apis , identity-security-cloud , roles	9	156	September 20, 2025
Assignment of a role via API's for bulk identities ISC Discussion and Questions apis , identity-security-cloud	2	148	November 9, 2024
Need Best Practice Solution ISC Discussion and Questions identity-security-cloud , provisioning	5	209	November 10, 2024
Issue with Bulk Access Profiles and Roles - Identities not added to Role ISC Discussion and Questions identity-security-cloud , roles	10	240	October 20, 2024
Creation of a bulk number of roles and the validity of each role ISC Discussion and Questions	6	1545	July 19, 2023

Assign a new role to existing identities in bulk

Related topics