I have seen several posts that touch on this, but none of them seem to answer a question I have. This feels like such a noob question. What is the difference between access granted by an access profile assigned to an “Active” Identity Profile (birthright), vs that same access profile assigned to a role, whose rule says LCS = “Active”?
If I understand correctly, the access assigned on an Identity Profile is assigned one time, when the LCS changes to that value, and is removed when the LCS changes to a different value. If a user is removed from an entitlement that is part of that access profile, then ISC does not re-evaluate and re-add them to the entitlement. Basically it fires once (unless the LCS changes away and then back to the same value).
An access profile assigned to a role with a rule that says LCS=“Active” is periodically reevaluated. If a user is removed from an entitlement, they will be granted that entitlement again when the identity is processed again.
Do I understand the difference correctly?