Automating access with SailPoint Identity Security Cloud lifecycle states

Community Events
,
1

How can you handle the explosive growth of human, machine, and agentic AI identities as well as the access they need? Keeping up with this presents a major organizational challenge – and opportunity for increased security! In this session, you’ll learn how to assign and remove access automatically, as people and machines transition through their relationships with your enterprise. You’ll also learn how this can strengthen security, optimize business efficiency, and eliminate administrative overhead - while facilitating governance and protecting your organization’s valuable digital assets.

Join the webinar to learn:

  • What is the business value of lifecycle states?
  • How can I automate access with lifecycle states?
  • What are identity states, and how do they relate to lifecycle states?
  • How do I implement lifecycle states in Identity Security Cloud?

Register now

1 Like
2

Has anyone thought of birthright roles partially based on lifecycle state, where adding roles and keeping roles follow different membership criteria?

For example, suppose we say the following as part of a leaver process:

  1. On day 1 of leaver process, we want to disable the accounts
  2. On day 7 of the leaver process, we want to remove all access of the accounts.

Why this difference? If HR was not aware that a contract got extended of an identity, day 1 would disable the account, but not remove the access, allowing the undesired impact to be relatively low: The user or their manager can reach out to HR and have it fixed, after which ISC will enable the accounts again. Not much damage was done, whereas if all access got removed, it can be a hassle to get it back again.

But what about birthright roles, do we also want birthright access to be removed on day 7? But surely if someone is on day 3 of being a leaver, the identity should not gain the role by birthright, right?

So from that perspective you should be able to define:

  1. Criteria to determine who should get the role added if they don’t have it yet.
  2. Criteria to determine who should keep the role if they already have it.

point 2 can then include the first leaver phase, and point 1 can exclude it.

1 Like