Certification campaign inconsistency

Identity Security Cloud (ISC) ISC Discussion and Questions
1

I have configured an access item certification campaign, for access profile XXXX. I just select it, then select to review all identities, select an individual for reviewing, and save. Performing a preview, it says that there are 4 identities to review.

But, if I search @access(name:”XXXX” AND type:”ACCESS_PROFILE”) it brings about 4K identities which has XXXX access profile.

Why is this divergence? Can it be something in reviewer identity, related to scope?

2

@jsosa Hello, please check if that access profile is not part of some birthright role, which grants that AP to these identities that don’t appear in campaign, which you want to certify.

3

Hi Julian,

Is your access item certification campaign defined by a Query? if so, can you paste the query here?

4

have you tried same search query for certification as well, this time go with identities that returns with query and check 4k identities are able to pull. Let me know.

5

Hi Jason, campaign is defined just selecting this “XXXX” access profile item, then selecting to certify all identities.

6

Hi! Yes, I have tried both approaches: entering XXXX in the query box, and selecting XXXX access item. Both cases lead to same result: 4 identities to review, instead of the 4k identities the access profile has.

7

Hi Marko! Apparently yes, access profile has been granted by some birthright role.

8

@jsosa “Hi! Yes, I have tried both approaches: entering XXXX in the query box, and selecting XXXX access item. Both cases lead to same result: 4 identities to review, instead of the 4k identities the access profile has“

  • does this mean that 4 identities appear in campaign, after the generation of campaign, or only 4 identities are able to be selected during the configuration of campaign (if you go with “Search based campaign“ steps etc..)?
9

Hi Julian,

I havent tested it myself, but I wonder if the difference is between Access Profile assigned by role vs Access Profile not assigned by role (either auto-detected or directly requested)

10

Hi Marko! 4 identities appears in campaign preview. When configuring certification, I select access item (access profile XXXX), and then, in identity selection, I simply select All.

I can see that 4000 identities has XXXX profile in search, using @access(name:XXXX)

11

@jsosa The birthright role which assigns that AP, is it granted by the request (is that role requestable), or identities grant that birthright role by certain identity criteria?

-I believe that in first case (if role was granted by the request), that AP won’t be shown in campaign for these identities(SailPoint will refuse to certify that as higher layer of abstraction is upon, in this case, birthright role which encapsulates that AP), unless you select that role(which contains your AP) to certify actually.

1 Like
12

Marko, we could confirm that problem was birthright role. We have created one as part of a solution to bulk assing some access profile to several identities. Our goal was to certificate this access, and when reviewer removes it, a workflow captures event and disable account.

So, we are removing birthright role now, we will assing access profile via script.

Thanks!

1 Like
13

This topic was automatically closed 60 days after the last reply. New replies are no longer allowed.