I had created a business role for people leaders whose manager status is true who having AD1 account and not having AD2 account. The role assignment seems to be working correctly like if i run eligible user, user getting added and non eligible user is not added and logs also showing as user not eligible. But the issue is role statistics showing users who are having AD2 account also but when opened the role ,Though entitlements tab is not having role but on role members list is not getting updated even after running the task “refresh role indexes”, i can’t run full udentity cube task because of using same Ad for both prod and UAT. Can someone suggest why the role statistics is showing wrong data.
Hi @lsaipriya26 , Refresh Role Indexes only rebuilds the statistics from existing role assignments; it does not re-evaluate the Business Role assignment rule.
You shouldn’t need to run a full Identity Refresh for all identities. Can you test with one affected identity and run an Identity Refresh with Refresh assigned and detected roles and promote additional entitlements enabled?
Then check if that user drops off the role members list. If not, check the Identity Refresh logs around the role evaluation and we can dig further.
@lsaipriya26 - You do not have to either run this against your full population:
Delta Identity Refresh - IIQ automatically flags identities as needsRefresh when their aggregated data changes, which your AD2 aggregation would have done. A delta refresh only processes flagged identities, rather than everyone, which is faster and a much smaller footprint to reason about in a shared environment.
Or scope a regular Identity Refresh with a Filter/Population targeting just the specific identities you are seeing incorrectly listed in the role stats, as a quick validation before trusting it more broadly.
Hello Priya. Refresh Role Indexes will not update Role Statistics. It is used for Role Search indexes.
I would test with one affected identity using a scoped Refresh Identity Cubes task with:
Refresh assigned and detected roles and promote additional entitlements
Refresh role metadata for each identity
Leave Provision assignments unchecked, so this will not provision changes to the shared AD.
First confirm that the Business Role is removed from the identity. Then click Refresh in the Role Statistics panel or run Refresh Role Scorecard.
If the role is still assigned after the scoped refresh, check that the AD2 account is linked to the Identity Cube and that the role was assigned by the assignment rule rather than manually.
The role itself is not assigned to the user profile in entitlement tab, it is only showing in members list. I did refresh identity on affected users ,logs shows assign role as false but from the members list the user is not getting dropped.
Hello Priya. Since the assignment evaluates false and the role is no longer assigned to the identity, this looks more like stale Role Statistics data.
For one affected identity, rerun Refresh Identity Cubes with Refresh role metadata for each identity enabled. Then open the Business Role and click Refresh under Role Statistics. Refresh Role Indexes will not refresh this Members list.
If the user still appears after those two steps, please share the Identity Refresh and Role Statistics refresh results. That would help determine why the scorecard is retaining the member.
@lsaipriya26 I found something interesting, Role Viewer Members grid doesn’t read RoleIndex or the entitlements join, it reads a separate store, Identity.roleMetadatas, which only gets written when Refresh role metadata is checked on Identity Refresh. That box is separate from Refresh assigned/detected roles, so your assignment logic worked correctly (entitlements tab clean, assign=false) but that metadata stayed stale.
Rerun Identity Refresh on the affected user with Refresh role metadata checked specifically, then click Refresh under Role Statistics on the role. Should work.
Thanks for the suggestions , and actually refresh identity with the role related options worked and almost all the users got removed from the list ,but i did see 5 users as wrongly added when i run refresh on them. i am not able to get any logs as stating identity is getting refreshed and last refresh is not getting updated on those users. any idea why this is happening. and my bad earlier i was testing with 2 of this id’s which makes me think refreshing identity is not working.
Hello Priya. Since the refresh corrected almost all users, the role-related refresh itself looks to be working.
For the remaining 5, since you are not seeing any indication in the logs that those identities are being refreshed, I would first confirm that they are actually being selected by the task.
For one affected user, run a temporary Refresh Identity Cubes task scoped only to that identity. Apart from the filter used to select that user, remove any other last-refresh window, Population, Refresh only identities marked as needing refresh during aggregation, or Exclude identities marked inactive restrictions.
Keep the same role-related refresh options enabled and Provision assignments unchecked. Then check the Task Result and logs for that one-user run. lastRefresh not changing alone does not prove the identity was skipped, since IIQ updates it when the refresh or aggregation changes the identity.
If the identity still is not processed, check the Task Result/logs for any warning or error, such as an ObjectAlreadyLockedException.
@lsaipriya26 Do you see refresh task executed on those 5 users or it got skipped? Could you please rerun the refresh task and share the task results details here.