Azure AD connector, in an access request when multiple roles sharing some common groups throwing exceptions

IdentityIQ (IIQ) IIQ Discussion and Questions
, , , ,
1

Which IIQ version are you inquiring about?

8.4p1

Share all details about your problem, including any error messages you may have received.

I have created a bunch of business roles that provision Azure AD/Entra ID groups. We have a couple of business roles that have common entitlements. When I’m trying to add business roles having common entitlements, IIQ is sending redundant requests. The business role provisioning already provisions the common groups, and the next role is also trying to provision the common groups, resulting in an error saying “Provisioning failed for **********. Entitlement ID: **********.Response Code - 400 Error - One or more added object references already exist for the following modified properties: ‘members’.”

2

@vineetkumarmishra

I would suggest adding a logic in before provisioning rule that checks the user’s entitlements or groups. If a group is already present remove it from the plan.