Hi everyone, is it possible to change one identity profile to another?
For example, if I have an identity in my identity profile 123 and I would like to change it to identity profile 001, is that possible?
yes it is possible, by going into accounts option under identity management. Find the account that needs to be correlated to a different identity. But clear on a part why you want move that
But is it possible to do this automatically? I need it to be automatic.
But why? are you having so many accounts from non auth sources need to correlate the desired identity profile?
I have a collaborator workflow where they will become a third party. In this case, the collaborator’s identity will be deactivated, and a third-party account will be created for them. This account correlates with the identity, and the identity is activated. However, it continues to consume the collaborator’s identity profile data, and I need to switch the identity profile to the third-party profile.
May be this SP doc helps you. It tells the migration between Authoritative sources.
An identity will always be under identity Profile depending on the auth source of that identity.
If you have 2 auth sources, say
- SoT-1 with Identity Profile IP-1
- SoT-2 with Identity Profile IP-2
Then all the accounts from SoT-1 will create identities under IP-1, same for SoT-2 / IP-2.
However, if you have an identity with accounts from both sources (ie an account from SoT-2 correlated with an identity from SoT-1 / IP-1 instead of creating a new identity) then you can decide whether the identity should be under IP-1 or IP-2. This is done by setting a higher priority to the identity profile that you want to be used.
Hi @guilherme_sec,
The profile from which the identity originates is determined based on priority. For example, if you have two authoritative sources (Auth1 and Auth2) and corresponding identity profiles (IdP1 and IdP2), where IdP1 has a higher priority than IdP2, then even if a user exists in both sources, the identity will still be sourced from IdP1 due to its higher priority.
However, as you mentioned, they later become third party users. In that case, my question is: do you set any flag on the identity or on the Auth1 account, or do you disable that account? If such a flag exists, you can use transforms to conditionally adjust priorities and determine which authoritative source should be used for attribute data. We have implemented a similar scenario using this approach.
Are you looking to set the identity profile priority? Check the documentation, there is a Priority variable, that if a user is part of more than one, it takes the priority into account. If the use case is, you have 1 “employee” profile, and another “3rd Party”, and you want the If, they are in both, put them in 3rd Party, the Priority should solve that. Just set the 3rd party at a higher priority. If you want it dynamic, the only way I know of, is to filter them out of the authoritative source, which will delete the account links.
So if you had a hypothetical employee → 3rd party. And you want 3rd party to always be selected, this can be solved via a priorty.
If you want employee → 3rd party = 3rd party, AND 3rd Party → employee = employee. The only way I know of is to filter the user out of the original authoritative source.
I would recommend adding this to the ideas page, as I can see a number of valid use cases to allow setting an “over ride identity Profile” style identity attribute via transform.
Does it allow setting of the priority based on the granularity of the identity? It seems what I read is using a transform to set the identity profile priority. Does that not change the priority for all identities? I am curious what the that would look like.
Or are you saying, you have a single Identity Profile, that uses a transform for each attribute like: (going to psudocode, I know the syntax is not right)
first Valid{ {if(auth.status==disabled){null}else{auth.attribute)},{if(auth2.status==disabled){null}else{auth2.attribute}, {static default value}}.
Or something akin to that? So no IdentityProfile swaps, but just a combined one?
Hi @marcmcgee,
Bingo, you got it right ! This approach will help you achieve your use case.
There will be no identityProfile swap, but in the transform you are considering both of your auth sources.
Yes, it is possible.
When accounts from different authoritative sources match to the same identity, the assigned Identity Profile depends on the configured priority. The profile with the higher priority takes precedence.
Yes, it is possible, but not as a direct manual “move identity from Identity Profile 123 to Identity Profile 001” action.
In Identity Security Cloud, an identity profile is tied to an authoritative source, and each identity can be associated with only one identity profile at a time. If the same person exists in multiple authoritative sources, ISC decides which identity profile the identity belongs to based on identity profile priority.
So, to move an identity from profile 123 to profile 001, the identity must exist on the authoritative source used by profile 001. Then either:
- Make profile 001 higher priority than profile 123, if the identity exists in both authoritative sources , 2. Remove the identity/account from the authoritative source behind profile 123 and aggregate/create it through the authoritative source behind profile 001.
After that, run aggregation/correlation and identity processing so ISC recalculates the identity profile association.
So the answer is yes, it can be achieved, but it is not done by directly editing the identity record. It is controlled by authoritative source membership, correlation, and identity profile priority.
I see this as a deficiency. In healthcare it is very common to have identities that are sourced from multiple authoritative sources. A typical situation is having an employed provider move to being an external provider. When the HR termination comes through, a complex transform is applied to review status in multiple sources. Ultimately, their identity profile will remain tied to their inactive employee identity profile, since the account isn’t being removed from the HR system. HR needs to have the highest priority, so switching priority isn’t a good solution. It would be great if there was a nice clean way to automate identity profile assignment based on account status.