Disable an account when all the entitlements are revoked for that account

Identity Security Cloud (ISC) ISC Discussion and Questions
,
1

Hi All,

I need to disable an account for a source of scim 2.0 when all entitlements associated with the account are revoked.

I was trying to write a Before Provisioning Rule for the same but there is no way I could get check the list of entitlements of the account.

Any suggestions on how we can implement this would greatly be appreciated.

TIA.

2

Hello Anusha,

I have implemented this using Workflows. We initially considered using a Before Provisioning (BP) Rule; however, due to the following constraints and limitations, we chose to implement it through a Workflow instead. I have attached the Workflow JSON for reference.

  1. In a BP Rule, we cannot verify whether the revoke request was completed successfully. In our use case, the account should be deleted only after the revoke request has been successfully processed.
  2. In a BP Rule, we cannot directly query the target system to confirm that the entitlements/access have been revoked successfully. We do not want to rely solely on SailPoint to determine whether the entitlements have been removed.
  3. There is also a dependency on deploying and testing cloud rules, which adds additional overhead.

I believe you can use SCIM APIs in workflow if that supports disable operation

CrowdStrikeDeleteUserAccountWhenAllAccessIsRevoked20260721.json (3.6 KB)

3

Hi @kanusha9

You can use for this purpose standard cloud rule “Services Standard IdentityNow BeforeProvisioning Rule”. It has a trigger “Entitlement Cardinality Update Triggers” which will let you change the action to disable account when the last role is removed.

The rule is created by SailPoint itself and you just need to make sure that it is available in your tenant and after you configure the events, this works fine.

Thank You.

Regards

Vikas

4

Hello Anusha. Both approaches shared above can work, it just comes down to how entitlements are set up on your source.

Like @vguleria mentioned, if all the access sits under one multivalued entitlement attribute (like groups or roles), the Services Standard IdentityNow BeforeProvisioning Rule can handle this using the Entitlement Cardinality Update Triggers with LastRemoved. Here’s what the event config would look like:

{
  "Operation": "Modify",
  "Entitlement Cardinality Update Triggers": [
    {
      "Attribute": "<your-entitlement-attribute>",
      "Operation": "LastRemoved"
    }
  ],
  "eventActions": [
    {
      "Action": "ChangeOperation",
      "Attribute": null,
      "Value": "Disable"
    }
  ]
}

Replace the attribute with the exact entitlement attribute from your account schema. What the rule does is, it reads the current aggregated values for that attribute, applies the pending Add/Remove requests from the provisioning plan, and when the last value is removed, it flips the operation to Disable.

If your source has access spread across multiple entitlement attributes though, LastRemoved won’t help here because it doesn’t check the combined state across attributes. It only evaluates the one attribute you configure. So in that case, or if the account should only be disabled after the target system confirms the revoke actually went through, I would go with @JackSparrow workflow approach. Use Provisioning Completed as the trigger, verify from the target that no access remains, and then call Manage Accounts to Disable (as long as your SCIM source supports account disable).

The attached CrowdStrike workflow is a good reference for the overall pattern, but it calls a CrowdStrike-specific delete API, so don’t import it as-is for your SCIM source.

5

you can check if the account has entitlements. the the Account/link object from plan and use below method to list entitlements on the account :

compare with entitlements being removed in the plan with the entitlements on account and call the appropriate operation to disable.