Best way to remove Azure groups on leaver process

IdentityIQ (IIQ) IIQ Discussion and Questions
,
1

Which IIQ version are you inquiring about?

Version 8.2

Share all details related to your problem, including any error messages you may have received.

Hi Community,

What is the best way to remove the Azure AD groups on the leaver process, also what is the best place approach to do so. Does it require me to build a PowerShell script please suggest.

Regards,
Charan

2

No need for powershell - the only thing you have to do is to create ProvisioningPlan and for each Azure AD account create account request in which for each entry in memberOf attribute you execute REMOVE operation.

Then you can just execute the plan in your leaver workflow.

3

@charan18
Is Azure application integrated with SailPoint in your case, also are you referring to remove the AD group membership of the user when the user is offboarded , instead of disabling or deleting the account?

Can you please provide more specifics here

4

@iamksatish

Yes, the Azure is integrated with SailPoint in my case.
I’m referring to removing all the memberOf groups from Azure application on Leaver event.

5

This is the example of the rule you can use to remove groups - you have to only execute the plan and check if I didn’t do any typo.

  • I assumed it is rule you can use in leaver workflow and identity variable is available in the step.
ProvisioningPlan plan = new ProvisioningPlan();

List links = identity.getLinks();

for(Link link :links) {
AccountRequest accReq;
if(link.getApplicationName().equals("Azure AD")) {
List groups = link.getAttribute("memberOf");

if(groups != null && !groups.isEmpty()) {
accReq=new AccountRequest();
accReq.setOperation(Operation.Modify);
accReq.setNativeIdentity(link.getNativeIdentity());

for(String group: groups) {
accReq.add(new AttributeRequest("memberOf",Operation.Remove,group);
}
plan.add(accReq);
}}
3 Likes
6

@charan18 if you have role assignment then use below approach, the bad outcome was when you will do refresh with provision assignment, it will again assign those memberships. so we handle sticky assignment by code in leaver.

Solved: Re: How to remove attributeAssignments by leaver workflow? - Compass (sailpoint.com)

2 Likes
7

This topic was automatically closed 60 days after the last reply. New replies are no longer allowed.