Best Practice To Restrict Leavers

Identity Security Cloud (ISC) ISC Discussion and Questions
1

Hi All,

Recently we had an issue in prod, where Leaver got triggered for 2K + users due to bad data coming from authoritative source.

Would like to understand the best practice to reduce such scenarios, Can we have any threshold like how we have in account aggregations.

2

I haven’t seen any threshold concept yet.

How is your leaver implemented, using workflows ? or disable accounts and/or remove access using LCS

3

Hi @MVKR7T ,

It’s using LCS.

4

In IIQ, we have Lifecycle events which has threshold concept. Events can be delayed as it needs a refresh task to be executed. So there can be a delay from Aggregation to Refresh, so we can do some analysis meanwhile.

But in IDN, I don’t think we have any control. When you run HR Aggregation task, automatically Identity Profile will be processing identities, calculating LCS.

You might loose some birthright access if LCS is in assignment criteria, disable source accounts.

You might need to build some custom solution outside IDN.

In one of my projects, we implemented a custom solution outside for IIQ

  1. Read data from HR application
  2. Analyze the data and consolidate Joiners, Movers, Leavers and Rehires
  3. Send a mail to HR team for confirmation.
  4. If any mistake, HR team will correct the feed. We will disable scheduled aggregation task.
5

This topic was automatically closed 60 days after the last reply. New replies are no longer allowed.