Create Account is getting trigger automatically after aggregation

[Faizan9097 (Md Faizan)]

Hi team,
I am working on Web Service connector which is requestable JML application. When I am provisioning the users through Entitlement tab we observed that after disable when I am running the aggregation we found that after the account got deleted from IDN it automatically called create operation. It is not happening when I am requesting through access profile.

[jesvin90 (Jesvin Joseph)]

Hi @Faizan9097,

Take a look into this thread. The entitlement stickiness could be the problem here as well.

Entitlements requested throught the request center keeps being provisioned

Hi @Rania, Welcome to the community. This is an expected behaviour as the entitlements have a sticky behaviour in ISC. Below are the only ways to revoke the entitlements correctly. Document [image] ISC will re-add the entitlement any other way you remove it. So if the account does not exist for the user, ISC would create the account and entitlement. Access profiles are one way to handle this (as they are not sticky). Or make use of the workflows to revoke entitlements with an HTTP action …

[Faizan9097 (Md Faizan)]

Hi @jesvin90 ,
If we need to go through entitlement only what approach we should take as our requirement is like this only to request through Entitlment tab.

[jesvin90 (Jesvin Joseph)]

Hi @Faizan9097,

Below are the only ways to revoke the entitlements correctly:

You can also make use of a Workflow to revoke entitlements using an HTTP action that invokes the revoke entitlement API. This can be triggered as part of an Identity attribute change in case of a termination scenario.

[Faizan9097 (Md Faizan)]

Hi Jesvin,
My concern is that after aggregation the account is getting deleted but after on the same account create account is getting called when requesting through entitlement tab.

[amansingh (Aman Kumar Singh)]

Hey Faizan,

As Joseph mentioned sticky entitlement is a known issue to invoke create and or Add operation back if the initial provisioning was performed via the request center through which the access request was processed.
We have encountered that issue as well for WebServices and JDBC sources and to solve this issue we have encompassed the entitlements within an access profile which stops the re-provisioning of an access.

[jesvin90 (Jesvin Joseph)]

Hi @Faizan9097,

Due to the stickiness of entitlements, ISC will try to re-add the entitlement back if it was not originally removed through any of the methods mentioned above.

This means that if the account itself got deleted in the first place, ISC would create the account first and then add the entitlement.

Creating access profiles is one way of overcoming the problem or you can make use of WF’s to remove entitlements.

Below is an article you can refer to :

Workflow to remove ALL leavers' standing access

Hi everyone, This workflow auto-revokes any standing access leavers have either through a micro targeted access certifications or by leveraging revoke access requests after being terminated. This should ensure that all leavers’ access is removed upon terminated and not just access assigned through birthright roles. Additionally, an audit trail is generated to document when and why the access was removed. This workflow was designed and built with the help and input of a multiple people! Thank…