Certification Automatic Revocation - Missing Groups from provisioning request

IdentityIQ (IIQ) IIQ Discussion and Questions
, ,
1

Which IIQ version are you inquiring about?

8.4

Share all details about your problem, including any error messages you may have received.

We were validating the revoking process from our certifications and one case stood out.

The Certification “Targeted Access Review for User2” had 16 entitlements being certificated for User1, all from the same application.

User2 revoked all of these accesses. The provisioning request was created, but only for 14 of the 16 accesses.

I can’t find any errors. These groups just seem to not be included.

Any ideas on how to go about trying to understand this issue would be appreciated.

Thanks

2

Did you check if there are any duplicate entitlements/access items? Sometimes IIQ consolidates duplicates in the provisioning plan, so you may see fewer items there than in the certification.

3

@tmamouros If I understand correctly, all 16 accesses were removed, but you can still see a provisioning request for 14 of the 16 accesses. Could you please check whether the user has any duplicate access assignments?

4

Hi @tmamouros

For the 2 missing entitlements, verify whether they are marked as Non-Requestable, inherited through a birthright or role-based access, or if they were filtered out by any provisioning policy or customization rule

5

Hi, were you able to find the cause of the missing entitlements?

6

@tmamouros Please check if those 2 entitlements got filtered out and it should tell you the reason. Is it happening for all users and with all certification or just for a specific ones.