I am facing an issue regarding the revocation of roles. We have a scenario where entitlements that have been successfully requested and assigned to an identity might also be part of a role requested and assigned to the same identity.
In this case, when I trigger a certification campaign, I can only see the role and decide whether the access should be approved or revoked. When I revoke the role, the separately assigned entitlement is removed too, even though it has its own independent assignment.
Is there any way to preserve the entitlement’s access if it was assigned separately from the role, when certifying (and potentially revoking) a role that includes that entitlement?
When removing the role manually through the Access panel in the Identity overview, the entitlement stays assigned. Is it possible to enable that same behavior for revocations triggered through a certification campaign?
Hi @fayadm ,
Manual role removal and certification-driven revocation seem to follow different logic paths. During manual removal, ISC appears to check whether the entitlement is also assigned independently before removing it. With certification revocation, that cross-check doesn’t seem to happen, so the entitlement can be removed along with the role.
A few possible approaches could be:
Separate the certifications — include entitlement-level certifications where this overlap is important, so reviewers can make the decision independently.
Avoid overlapping entitlements in roles, where possible, to eliminate the ambiguity.
Post-remediation correction — use a scheduled workflow to identify and re-provision entitlements that were independently assigned but removed during role revocation.
Since ISC is already able to identify independent assignments during manual removal, I think this inconsistency is worth raising with SailPoint Support/Compass to confirm whether it’s expected behavior.
This is expected behavior in certifications. When a role is revoked through a certification campaign, SailPoint removes the access associated with that role, and it does not always distinguish whether an entitlement is also assigned separately. As a result, the entitlement can be removed as well.
Unfortunately, certification revocations do not behave the same way as manually removing a role from the Identity Access panel, where direct entitlement assignments are preserved.