# Best Practice for Creating new BirthRight Role

**URL:** <https://developer.sailpoint.com/discuss/t/best-practice-for-creating-new-birthright-role/19752>\
**Category:** SHF Discussion and Questions\
**Tags:** sailpoint-identity-security\
**Created:** [October 25, 2023, 11:23am UTC](https://developer.sailpoint.com/discuss/t/best-practice-for-creating-new-birthright-role/19752 "2023-10-25T11:23:23Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![maheshtare](https://avatars.discourse-cdn.com/v4/letter/m/aca169/32.png) [@maheshtare](https://developer.sailpoint.com/discuss/u/maheshtare)\
**Post date:** [October 25, 2023, 11:23am UTC](https://developer.sailpoint.com/discuss/t/best-practice-for-creating-new-birthright-role/19752/1 "2023-10-25T11:23:23Z")

</div>

Hi All,

We have around 20K Identities and we have a requirement to create new birth-right role which will create application account and assign specific role inside the application to existing 20K users. Target application is a WebService based application so we are checking the API limit.

However, we would like to know if there is any impact on SailPoint if it triggers create account/add entitlement operation for all 20K users or what are the best practices we need to follow in such scenarios

---

<div class="post-metadata">

**Author:** ![KRM7](https://sea1.discourse-cdn.com/sailpoint/discuss/user_avatar/developer.sailpoint.com/krm7/32/2685_2.png) [@KRM7](https://developer.sailpoint.com/discuss/u/KRM7)\
**Post date:** [October 25, 2023, 1:09pm UTC](https://developer.sailpoint.com/discuss/t/best-practice-for-creating-new-birthright-role/19752/2 "2023-10-25T13:09:35Z")

</div>

I don’t think there would be an issue as Account Provisioning in IDN is sequential, so there will be a delay in between provisionings.

I have done this earlier for around 6K users, I didn’t face any issue.

Maybe you can add extra condition department or location or some other attribute to process the users as a batch.

---

<div class="post-metadata">

**Author:** ![edmarks](https://sea1.discourse-cdn.com/sailpoint/discuss/user_avatar/developer.sailpoint.com/edmarks/32/2896_2.png) [@edmarks](https://developer.sailpoint.com/discuss/u/edmarks)\
**Post date:** [October 25, 2023, 1:24pm UTC](https://developer.sailpoint.com/discuss/t/best-practice-for-creating-new-birthright-role/19752/3 "2023-10-25T13:24:34Z")

</div>

About 1.5 years ago I saw a demo with 100K identities and it had adverse impacts on the tenant. Things have obviously changed since then, but I agree with @KRM7 that doing it in smaller batches, at least to start, is probably a better approach to ensure it’s working EXACTLY as expected before turning it loose on 20K identities.

---

<div class="post-metadata">

**Author:** ![system](https://global.discourse-cdn.com/sailpoint/original/2X/f/f2136700ed5e3703e0b85e02f6be799dacca7735.png) [@system](https://developer.sailpoint.com/discuss/u/system)\
**Post date:** [December 24, 2023, 1:25pm UTC](https://developer.sailpoint.com/discuss/t/best-practice-for-creating-new-birthright-role/19752/4 "2023-12-24T13:25:11Z")

</div>

This topic was automatically closed 60 days after the last reply. New replies are no longer allowed.