We have a scenario involving two roles under an SOD (Separation of
Duties) conflict policy and time-based provisioning (Sunrise/Sunset).
Looking for guidance on OOTB feasibility.
Scenario:
Role A = Elevated/privileged role, assigned via Sunrise/Sunset
(time-based provisioning)
Role B = Standard role, already exists on the identity
Role A and Role B are configured as SOD conflicting roles
Expected Behavior:
When Role A is assigned (Sunrise) → Role B should be automatically
revoked due to SOD conflict
When Role A is removed (Sunset) → Role B should be automatically
restored/re-provisioned back to the identity
Questions:
Can IIQ auto-revoke Role B on SOD conflict detection OOTB?
Is there a native way to restore Role B once Role A is sunset —
without a manual re-request?
Does the platform retain memory of the pre-existing Role B
assignment to enable restoration?
If not fully OOTB — is a custom Workflow or Rule the recommended
approach?
Any guidance, documentation references, or community experience
would be highly appreciated!
This may be achieved using assignment criteria for Role B. Is the Role B automatically assigned to users or your are requesting it. If assigned automatically then you can use rule option and put your condition to check for Role A when assigning Role B. The rule will return false if user has Role A assigned which will ensure that Role B is automatically removed when Role A is assigned.
If you are requesting the role then this may not work for you.
@Levi You can make use of violation Business process which will be used when there is a violation detected. To identify which one to remove, you can make use of the assignment date.
ProvisioningTransaction table or audit to re-provisioned the earlier role once sunset of the other role.
@Levi Simple approach is to use the Roles with assignment criteria.. where you can check of RoleA is not assigned, then assign RoleB.. You don’t need policy for this dynamic assignment and removal.
