Configuring Workflow to Remove all OOTB Entitlements in IdentityNow

At a very highlevel, you can use a workflow to remove access outside of birthright auto-mapped roles (as you already referenced here:
Workflow to Remove ALL Leavers’ Standing Access
)

The challenge will be in trying to find out which out-of-birthright-access has been granted via approved access requests. I am not aware of any effective or easy way - within workflows at least - to find out whether certain access was provided through access requests.

Hence, the best approach might be to simply use workflows to generate a Mover certification campaign and assign it to the new manager to decide. Other SailPoint ISC components, such as the AI recommendations engine, should highlight any out-of-normal access items the mover has to the reviewer so they can make better decisions.

1 Like