Disable account when access is removed

Identity Security Cloud (ISC) ISC Discussion and Questions
, , , , , ,
1

We have a few sources where we would like to disable the account when access is removed.

I cant think of a way to implement this OOTB, like in role criteria or workflow.

We would want to implement this for SailPoint provided connectors such as SalesForce or AWS etc. as well as Web Service sources, ideally with a solution that is general and applicable with all/most sources.

(eg Web Service Before Operation could achieve it, but that would only be for Web Service sources)

At the moment, when user loses all roles for a given application/source, the account still remains active, just without the entitlements.

Scenario we would like to implement.

(Steps 1-4 are all OK, missing piece is step 5)

  1. User requests role for Application.

  2. IDN provisions account/updates source account with requested entitlement(s)

  3. Role is revoked

  4. IDN updates account to remove entitlement(s)

  5. If identity has no more roles that give access to Application, then account should be disabled

Is this common at other organisations?

Thank you

1 Like
2

It is not possible to remove all the entitlement from salesforce account.

3

How about a workflow that triggers on Provisioning Completed, and, after checking the type of Provisioning process , for each of the account requests in the trigger input:

using Search API check if the identity is left with any entitlement in the specific Source, with a query that would look something like:

`id:{{recipient.id from trigger}} AND @access(type:ENTITLEMENT AND source.name:{{from trigger account requests}})`

and if no entitlements are left (result body is empty) then Disable account in that source

2 Likes
4

Any particular reason that you want to disable access when there are no underlying entitlements?

Also, if you did disable the account, you would have to have another program to re-enable it once it got provisioned with a new entitlement.
Sounds like a lot of work for what is really just a cosmetic feature

5

Hi Phil,

  1. Some applications base licensing on number of active accounts
  2. Business is concerned that users could still log in to backend application, when they shouldn’t be able to anymore. Even if their roles are removed, there still might be actions they could take or data they can view.
6

Thanks @iamology that sounds like the way to go.

7

This topic was automatically closed 60 days after the last reply. New replies are no longer allowed.