Confusion About User Permissions in SailPoint IdentityNow – Need Clarification

Identity Security Cloud (ISC) ISC Discussion and Questions
1

I’ve been reviewing the available actions for users in SailPoint IdentityNow and came across the following question (snapshot attached):

What are some of the actions available to users in IdentityNow? (Select all that apply)

  1. They can do any work assigned to them.
  2. They can do an access review.
  3. They can see the status of all users.

image
image954×466 11.8 KB

My Confusion:

  • In the first option, it’s clear that tasks must be “assigned to them” for users to perform them. This makes sense for both regular users and those with specific responsibilities.
  • However, in the second option, there’s no mention of tasks being assigned. If we think from the perspective of a simple end user, how would they be able to do an access review if it’s not explicitly assigned to them? Access reviews are typically meant for managers or reviewers, right?
2

@rohitmisal45 -

You’re correct in your understanding, and your confusion is understandable given the wording of the options. Let’s break down each option:

  1. They can do any work assigned to them.
  • Explanation: This is accurate. In SailPoint IdentityNow, users can perform tasks that are explicitly assigned to them, such as completing a certification (access review) or fulfilling a request.
  1. They can do an access review.
  • Explanation: This option is also valid, but with the crucial context that the access review must be assigned to them. In IdentityNow, access reviews (also known as certifications) are typically assigned to managers, application owners, or designated reviewers. Regular users can perform an access review only if they have been assigned one.
  1. They can see the status of all users.
  • Explanation: This is generally not available to regular users. Viewing the status of all users is typically a capability reserved for administrators or users with specific permissions.

Addressing Your Confusion:

  • Access Reviews and Assignments: In IdentityNow, access reviews are indeed usually assigned to specific individuals responsible for certifying access—such as managers or designated reviewers. Regular end users would not have the ability to perform access reviews unless they have been assigned that task.
  • Implication of the Options: While option 2 doesn’t explicitly mention “assigned to them,” it is implied within the context of the platform’s functionality. Access reviews can’t be performed arbitrarily; they must be part of an assigned task.
2 Likes
3

I would suggest you to not to over think, which will give you confusions. Consider yourself like a beginner and doesn’t have much knowledge. Then you don’t get much confusions, that’s what I do in SailPoint certifications :stuck_out_tongue:

Question referring to users (User level)

  1. They can do any work assign to them, irrespective of your permission level, you are allowed to do all the works assigned to you.
  2. They can do access review, yes users can do an access review, you don’t need additional permission/level to review an access, you just need to be manager/owner which is not a user level again.
  3. They can see the status of all users, only org admins can see that.

Cheers
Krish

1 Like
4

Thank You @officialamitguptaa !!

5

Thanks @MVKR7T advice! :blush: I’ll definitely keep that beginner’s mindset in mind to avoid overthinking.

1 Like
6

This topic was automatically closed 60 days after the last reply. New replies are no longer allowed.