Business Roles with IT roles that can be auto assigned as well request based

IdentityIQ (IIQ) IIQ Discussion and Questions
,
1

Hi All,

I have a requirement where we need to configure Business Roles. It has IT roles grouped together with two categories together - Auto-assigned (Required) and Request-based(Permitted). How do I group this in a single role in IIQ. Please suggest a high-level solution. Eg BizRole 1 has IT Role1, IT Role 2 - should be auto-assigned and IT Role 3 - should be request based. Thanks

2

@nmuthusamy

You can use the OOTB feature of SailPoint IIQ Business Roles.

For Example - Create a Business Role and assign the roles to the Required Roles section, which needs to be auto-assigned. Request-based roles should be added in the Permitted Roles section.

Thanks

3

@msingh900 You can try creating the roles as mentioned by @msingh900 .

Additionally, don’t mark these permitted roles as requestable. Once business role is assigned, they will automatically become requestable for that user.

4

In IdentityIQ you can keep both auto-assigned and requestable IT roles inside a single Business Role by using the assignment type setting at the IT-role level. For your example, create one Business Role (BizRole1) and add all three IT roles to it. Mark IT Role1 and IT Role2 as Required, which means they will be automatically assigned whenever BizRole1 is assigned to a user. Then mark IT Role3 as Permitted, which makes it optional/requestable under that same Business Role.

With this setup, when BizRole1 is granted (either manually or via role assignment rule), IdentityIQ will automatically provision IT Role1 and IT Role2, while IT Role3 will appear as an optional access item that users or requesters can select if needed. This allows you to group mandatory and optional access under one Business Role without creating separate roles.

5

Hi @nmuthusamy ,

As @msingh900 mentioned, you can configure business role with required and permitted IT roles.

When someone requests business role, requester can have choice - Permitted role along with its entitlements should be provisioned or not. Required IT role and its entitlements are provisioned anyway.

6

Required roles will get automatically assigned along with its entitlements but permitted roles won’t get automatically assigned even if they are present in the Business role

They need to requested.