Hello everyone,
We have already created a workflow that triggers a certification for mover scenarios. Is there a way to auto revoke those certifications if it is already past the due date and the manager has not signed off the certification?
Hi @jmmb ,
Yes, this can be handled natively in ISC. When creating the mover certification, configure how undecided items should be handled when an admin completes the campaign. ISC supports maintaining the access or allowing the admin to choose between maintaining/revoking it.
SailPoint recommends maintaining undecided access by default, due to the difficulty of reinstating access after an automatic revoke.
If your requirement is specifically to revoke all undecided access after the campaign is past due, you can use the Complete Campaign API with autoCompleteAction: REVOKE. The API is designed to complete campaigns that are past due.
Also, if the manager has already made decisions but has not signed off, those decisions are preserved; the revoke action applies only to the remaining undecided items.
So, for a mover use case, I would first use the native certification completion settings and only add a workflow/API layer if you specifically need the campaign to be automatically force-completed and revoked after the deadline.
Thank you.