Audit Logs for Scheduled Work Reassignment Deleted

I was able to use /beta/reassignment-configurations for logs of Scheduled Work Assignments that are Expired or Active in the organization. However, users are able to delete Scheduled Reassignments.

Documentation show audit records are captured when reassignments are created or deleted:
“Identity Security Cloud creates audit records when reassignments are created or deleted, capturing both the action and the user who performed it. Audit records also capture when automatic reassignments occur based on these configurations.”

How would I get audit logs for Scheduled Work Reassignments that were deleted?

Hi @schen,

Greetings!

Sharing my inputs as I tested:

Events for creation of work reassignment searchable with query in UI: “Create Work Reassignment Passed”
Events for deletion of work reassignment searchable with query in UI: “Delete Work Reassignment Passed”

Events/logs generated when work reassignment configured by self, manager or admin.

Hope this help :slight_smile:

Hi Amar!

I appreciate the help. It doesn’t seem like the Event Logs actually show what the settings are:


Our compliance team need to see when a work reassignment is created or deleted and what the settings were to validate approved access that were automatically forwarded to users.

Is there another way to show what specific work reassignment settings were deleted/created?
We want this information to include what was being forwarded, to who, and for what duration.

Hi @schen,

ISC beta API does provide details around work reassignment configuration

Thanks

This API appears to only provides active work reassignment configurations, but documentation states there will be logs of deleted work reassignment configurations.

Is there a way to get historical work reassignment configuration?

I didn’t find any information on deleted work reassignment configuration, opening a Sailpoint ticket might help in getting answer.

This topic was automatically closed 60 days after the last reply. New replies are no longer allowed.