Best way to remove all the entitlements from Azure AD accounts

[nikhlesh (Nikhlesh Sheoran)]

HI,

What is the best way to remove all the entitlements from the Azure AD account aggregated through the Azure AD connector?

Is it through Before provisioning rule, Before script or anything else is recommended?

Thanks.

[MVKR7T (Krishna Mummadi)]

Need to know more context here, is it one time activity or you need to remove as part of leaver or something else. Based on that we can look for best approach.

Possibilities are

1. Before Provisioning Rule
2. native Rules
3. Workflows

[nikhlesh (Nikhlesh Sheoran)]

We need to remove all the entitlements as part of Leavers.

[MVKR7T (Krishna Mummadi)]

Best way is to implement using Workflow. You can use this as a reference.

Workflow to remove ALL leavers’ standing access - IdentityNow (IDN) / IDN Show and Tell - SailPoint Developer Community Forum

Note that, workflow is a licensed module.

[nikhlesh (Nikhlesh Sheoran)]

Thanks Krishna for link but unfortunately we don’t have the Workflow module enabled.

[MVKR7T (Krishna Mummadi)]

Azure AD account can be controlled through AD account as well. If you disable AD account, Azure AD account also gets disabled as there will be sync.

In your LCS leaver, you might have already selected sources to disable.

Before Provisioning Rule
check Account Request operation, if it is disable then add account requests to remove all the entitlements.

1. If user is assigned with some Roles automatically using some conditions then, add LCS condition so that leaver will be removed from the Role(s).

2. If there are any manually requested Roles then those Roles will add Entitlements to the user again though you removed through Rule.

Depends on how your RBAC is modelled.

Certification Campaign

1. Disable user AD or Azure AD account first
2. Create a certification campaign for all leavers, ask certifier to revoke all the Roles.

Pick the use cases suitable for your requirement/environment.

[nikhlesh (Nikhlesh Sheoran)]

We are already using the Before Provisioning Rule to remove entitlements from On-Prem AD accounts. However, in this case, we need to do this for Azure-only accounts (not synced with On-prem AD). These accounts are created through the Azure AD connector.

Certification is always an option but we need to remove them automatically 30 days after End date.

[MVKR7T (Krishna Mummadi)]

Ya same goes for Azure AD as well. You can remove through Before Provisioning Rule. Are you disabling Azure AD account for leaver, if yes then how ? Using LCS in Identity Profile ?

[nikhlesh (Nikhlesh Sheoran)]

Yes, using LCS we are disabling the users.

Can we use Before Provisioning rule same as how we use it for On-prem AD? I though Azure AD connector uses Graph APIs to do operations and we might need to use Before script or powershell script to do so.

[MVKR7T (Krishna Mummadi)]

I see your point. Azure AD connector does support provisioning. I don’t think we need to make use of Native Rules to handle through PowerShell.

https://documentation.sailpoint.com/connectors/microsoft/azure_ad/help/integrating_azure_active_directory/account_management_for_user_fd_and_gu.html