Entitlement Removal After User Termination for Non-SailPoint Managed Access

SailPoint Human Fabric (SHF) SHF Discussion and Questions
, , ,
1

How can entitlements be revoked after a user is terminated when those entitlements were not provisioned through SailPoint? The entitlements are assigned directly at the endpoint level. For example, in Microsoft Entra ID, many application roles and group memberships are assigned directly within the application rather than through SailPoint. I explored implementing this through a workflow, but it does not appear to be a feasible solution due to the loop limitations within SailPoint workflows.

Please consider addressing the following when creating your topic:

  • What have you tried?
  • What errors did you face (share screenshots)?
  • Share the details of your efforts (code / search query, workflow json etc.)?
  • What is the result you are getting and what were you expecting?
2

Hi @mohnishkumar2023 ,

ISC triggers the workflow → workflow calls out PowerShell Script → script uses Microsoft Graph to strip group/app-role/directory-role assignments directly, bypassing the connector entirely.

Please refer below flow:

  1. ISC workflow (or Event Trigger) fires on lifecycle state change to Terminated.
  2. Workflow call PowerShell script.

This way ISC just does “detect + hand off,” and the script does the actual iteration — no loop ceiling to worry about.

3

Hi @suraj_gorle ,

How can a PowerShell script be invoked from a workflow? There doesn’t seem to be a direct action available to execute a PowerShell script. Do you have any suggestions on how this can be achieved?

Regards,

Mohnish Kumar

4

Hi @mohnishkumar2023 ,

using windows server action you can execute powershell. Please refer below screenshot.

image
image1417×800 61.8 KB

5

Here in Authentication Username is service account is passed or any user who has account in ad can be passed.

image
image712×515 24 KB

6

Service account and password which have permission to run script on server.