# Does anyone have a report on overlapping entitlements in Access Profiles

**URL:** <https://developer.sailpoint.com/discuss/t/does-anyone-have-a-report-on-overlapping-entitlements-in-access-profiles/28023>\
**Category:** SHF Discussion and Questions\
**Tags:** access-profiles, sailpoint-identity-security, entitlements\
**Created:** [January 30, 2024, 3:54am UTC](https://developer.sailpoint.com/discuss/t/does-anyone-have-a-report-on-overlapping-entitlements-in-access-profiles/28023 "2024-01-30T03:54:32Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![Tellius](https://avatars.discourse-cdn.com/v4/letter/t/3ab097/32.png) [@Tellius](https://developer.sailpoint.com/discuss/u/Tellius)\
**Post date:** [January 30, 2024, 3:54am UTC](https://developer.sailpoint.com/discuss/t/does-anyone-have-a-report-on-overlapping-entitlements-in-access-profiles/28023/1 "2024-01-30T03:54:32Z")

</div>

I need to find all Access Profiles that have entitlements and what those entitlements are so we can remediate them appropriately as some have been incorrectly added during our onboarding phase, which is now leading to some complexities when revoking access in reviews.

I was wondering/hoping if someone has managed to solve this one before before I start pulling down the raw data via api and doing a comparer in a script.

---

<div class="post-metadata">

**Author:** ![2135797](https://avatars.discourse-cdn.com/v4/letter/2/8797f3/32.png) [@2135797](https://developer.sailpoint.com/discuss/u/2135797)\
**Post date:** [January 30, 2024, 9:46am UTC](https://developer.sailpoint.com/discuss/t/does-anyone-have-a-report-on-overlapping-entitlements-in-access-profiles/28023/2 "2024-01-30T09:46:24Z")

</div>

Hi @Tellius,  
By using below query in UI search get all access profiles.  
query: \*  
download file including entitlement details as shown below, then you are able to see entitlement names which are part access profiles and verify.

 ![image](https://global.discourse-cdn.com/sailpoint/original/2X/5/5a895cfd5865c51f4d23fdf7a86c5e3cdfdcbd51.png)

---

<div class="post-metadata">

**Author:** ![Tellius](https://avatars.discourse-cdn.com/v4/letter/t/3ab097/32.png) [@Tellius](https://developer.sailpoint.com/discuss/u/Tellius)\
**Post date:** [January 31, 2024, 12:20am UTC](https://developer.sailpoint.com/discuss/t/does-anyone-have-a-report-on-overlapping-entitlements-in-access-profiles/28023/3 "2024-01-31T00:20:51Z")

</div>

@2135797 - Thanks mate. I was hoping for something I could hand over to a non-tech savvy analyst.

All good, I will script something up to get all the information. It doesn’t seem that there is a native way in the UI to get the data.

---

<div class="post-metadata">

**Author:** ![colin\_mckibben](https://sea1.discourse-cdn.com/sailpoint/discuss/user_avatar/developer.sailpoint.com/colin_mckibben/32/37182_2.png) [@colin\_mckibben](https://developer.sailpoint.com/discuss/u/colin_mckibben)\
**Post date:** [March 15, 2024, 3:27pm UTC](https://developer.sailpoint.com/discuss/t/does-anyone-have-a-report-on-overlapping-entitlements-in-access-profiles/28023/4 "2024-03-15T15:27:49Z")

</div>

Hi Tyson. Did you successfully create a script for this? If so, would you mind sharing your code for others to use? This solution could really benefit the community.

---

<div class="post-metadata">

**Author:** ![Tellius](https://avatars.discourse-cdn.com/v4/letter/t/3ab097/32.png) [@Tellius](https://developer.sailpoint.com/discuss/u/Tellius)\
**Post date:** [March 19, 2024, 12:51am UTC](https://developer.sailpoint.com/discuss/t/does-anyone-have-a-report-on-overlapping-entitlements-in-access-profiles/28023/5 "2024-03-19T00:51:29Z")

</div>

Hi Colin,

Sure can do! The comparer script is in powershell because that is what we have widely accessible on corporate desktops. However the process is basically

Go to IDN Search  
Select “Access Profie” in the filter  
Search: \*  
Download the result to csv named as: AP\_entitlements.csv  
Execute the following script:

```auto
## Input the Raw Access Profile data from CSV (change path and filename as required) 
$APRawData = Import-Csv -Path "C:\Temp\IDN\AP_entitlements.csv"

## Group the Access Profiles by Entitlement ID, then Name, then Source
$GroupsOfAPbyEnt = $APRawData | Group-Object -Property "Entitlement ID","Entitlement Name","Source Name"

## Find All Access Profiles where they have 2 or more entitlements with the same Entitlement ID
$GroupsOfAPWithOverlappingEnt = $GroupsOfAPbyEnt | Where-Object { $_.count -ge 2 }

## Build an array for outputting a report data
$allData = @()

## Loop through all the APs with overlapping entitlements and getting the data in a useful format for reporting
Foreach ($GroupOfAP in $GroupsOfAPWithOverlappingEnt)
{
	$obj = New-Object PSObject -Property @{
    		EntitlementID = (($GroupOfAP.Name -split ",")[0]).Trim()
		EntitlementName = (($GroupOfAP.Name -split ",")[1]).Trim()
		SourceName = (($GroupOfAP.Name -split ",")[2]).Trim()
		AccessProfileName = $GroupOfAP.Group.Name -join "|"
    	}
    	$allData += $obj
}

## Output the data in a CSV with the Entitlement Name, its source, and the Access Profile it belongs to (Change path and fillename as required)
$allData | Select EntitlementName,SourceName,AccessProfileName | Sort-Object SourceName,Entitlement | Export-CSV -NoType -Force -Path "C:\Temp\IDN\AP_Analysis_new.csv"

```

The downside is it needs someone saavy enough to execute the script but otherwise works for our particular needs.

---

<div class="post-metadata">

**Author:** ![system](https://global.discourse-cdn.com/sailpoint/original/2X/f/f2136700ed5e3703e0b85e02f6be799dacca7735.png) [@system](https://developer.sailpoint.com/discuss/u/system)\
**Post date:** [May 18, 2024, 12:52am UTC](https://developer.sailpoint.com/discuss/t/does-anyone-have-a-report-on-overlapping-entitlements-in-access-profiles/28023/6 "2024-05-18T00:52:14Z")

</div>

This topic was automatically closed 60 days after the last reply. New replies are no longer allowed.