Certifications - Behaviour

IdentityIQ (IIQ) IIQ Discussion and Questions
,
1

We are planning to enable the Revocation Phase in our new Certification Definitions. Before deploying this change to production, we need to clarify the exact behavior of historical, active, and new access reviews regarding “Revoke” decisions.

Could any one of you please provide technical responses to the following scenarios?

Scenario 1: Active Access Reviews (Launched BEFORE enabling Revocation Phase)

If a manager selects a “Revoke” decision inside an active review that was created before the Revocation Phase was enabled:

Will this review dynamically adopt the new Revocation Phase configuration upon expiration/sign-off, or will it strictly follow the original lifecycle configuration under which it was generated?

When will the actual provisioning requests (or manual work items) for these “Revoke” decisions be generated and executed against target applications (e.g., Active Directory)?

Will sign-off trigger immediate automated provisioning upon completion, or will it wait for the Perform Maintenance task (CertificationFinisher)?

Scenario 2: Already Completed/Finished Access Reviews (Past Historical Reviews)

For access reviews that are already in the Completed/End phase prior to enabling the Revocation Phase:

Does enabling the Revocation Phase in the Certification Definition alter or re-open completed/archived certifications in any way?

Is there any risk that enabling this option will cause previously completed or staged “Revoke” decisions to re-trigger provisioning requests during subsequent Perform Maintenance executions?

Scenario 3: New Access Reviews (Launched AFTER enabling Revocation Phase)

For new reviews launched with the Revocation Phase enabled:

When a manager selects “Revoke” and signs off on the review, does automated provisioning to target applications (e.g., Active Directory) execute immediately, or does it wait until the entire Revocation Phase duration expires?

If an application owner/remediator manually completes a revocation task inside the Revocation Phase UI before the phase end-date, does IIQ trigger provisioning immediately or wait until the full phase closes?

How does IIQ handle un-remediated “Revoke” items at the end of the Revocation Phase when automatic remediation/provisioning is enabled?

Let me know if anyone has faced this?

2

Hello Sailpoint Cipher, the Revocation Phase mainly adds tracking and escalation, it does not change whether revokes get processed. Revocations are processed with or without the phase; without it, they are just not tracked. And a certification locks in its phase config when it is generated, so editing the definition only affects future certifications, never ones already running or signed off.

For your three scenarios:

  1. Active reviews from before the change: they keep their original lifecycle and will not gain the phase. Without Process Revokes Immediately, “revocations are not launched until the certification is signed off”, and the work is actually generated by Perform Maintenance (Finish certifications) once the cert is eligible, so expect it during the next successful eligible maintenance run rather than the instant you sign off.
  2. Completed or archived reviews: not reopened, and the change does not reprocess revokes that already ran. I would just check for any cert left unfinished or remediation still pending from before.
  3. New reviews with the phase on: if a challenge period is active, the revocation request is not sent until the revocation is accepted or the challenge period expires; otherwise, it goes at sign-off, not at phase expiry. For a manual work item, the assignee does the change in the target and clicks Complete to confirm it, which does not itself provision. Unactioned items get the configured reminders and escalations, though note those apply only when revocation is handled through manual work items, not when it is processed automatically. The scan only updates status, it is not a retry for a failed provisioning, so for an automatic failure check the provisioning transaction.

With Process Revokes Immediately, each revoke goes out when the decision is saved and can no longer be changed, subject to challenge handling if a challenge period is active.

Before prod, I would test one old and one new review with a throwaway AD entitlement and check the Revocation Live Report, the provisioning transactions, and actual AD membership. Also make sure Transition certifications phases, Finish certifications, and Scan for completed revocations are enabled in Perform Maintenance, since certs do not advance on their own.

Which IIQ version are you on, and is Process Revokes Immediately (and the Challenge Phase) enabled?

3

Its 8.5 and no challenge period is not enabled.

4

Thanks for confirming. With IIQ 8.5 and no Challenge Phase, the key setting is Process Revokes Immediately.

  • Enabled: revocation processing starts when the reviewer saves the Revoke decision, before sign-off.
  • Disabled: revocation requests are processed after sign-off, when Finish certifications processes the eligible certification during Perform Maintenance.

Either way, revocations do not wait for the Revocation Phase to expire, and existing certifications keep their original configuration.

When the revocation request is submitted, it is not the same as the access being gone, so test with one AD entitlement: check the provisioning transaction (after saving the decision if enabled, or after sign-off and the maintenance run if disabled), then verify the actual AD membership.