I’m new to SailPoint Identity Security Cloud (ISC) and need some help with designing two related workflows for a CyberArk Privilege Cloud Shared Service SaaS source.
Requirement 1 – Remove CyberArk Entitlements when Identity Becomes Inactive
When an identity becomes inactive or terminated, the CyberArk account gets successfully disabled. However, the CyberArk entitlements remain linked to the identity/account.
I’m building a workflow (screenshot attached) to handle this cleanup.
The issue I’m facing:
I’m unable to filter the access items to only process CyberArk entitlements.
Could someone please share:
A working filter expression or query that limits the entitlements to only those from a specific source (CyberArk in my case) and in which step should I place the same?
Or an alternate approach/workflow pattern to safely remove only CyberArk entitlements when the identity is terminated?
Requirement 2 – Disable CyberArk Account When Last Entitlement Is Removed
In this case, the identity remains active, but if the last CyberArk entitlement is removed (manually or through role revocation), I need to automatically disable the CyberArk account.
I’ve tried using the Provisioning Completed trigger, but I need a filter that only captures:
operation = Remove, and
source = CyberArk Privilege Cloud Shared Service SaaS.
Additionally, what would be the best way to:
Check whether this was the last entitlement removed, and
If yes, disable the CyberArk account.
Any suggestions or examples on how to structure this logic (filters, operators, or expressions) would be greatly appreciated.
I don’t think selecting the source in the enable/disable section will limit the access removal to just that source. Remove All Access does exactly that, it removes all detected access items except for anything given by a birthright role and anything given by the configured LCS. You may want to test that with a test identity before configuring it.
You’re absolutely right here. Enabling or disabling individual sources has no impact on the “Remove All Access” option. This option operates independently and is designed to revoke all entitlements across every source where the identity holds accounts and we’ve tested this.
Thank you for your response and for sharing the “Remove All Access” feature, I did review that announcement.
In our case, we don’t want to enable Remove All Access, since that would remove access from all connected sources.
The requirement here is to specifically target and remove only the CyberArk entitlements (while leaving access to other systems intact).
That’s why I’m trying to build this logic through a workflow that filters and processes only the CyberArk source.
If you could take a look at that thread, I’ve shared the full configuration and the behaviour I’m observing. Any guidance on resolving that would be really appreciated.
