I would like to take a moment to thank @Bassem_Mohamed for his valuable help, inputs and comments.
Business Challenge
When organizations expand their identity management programs, they usually avoid granting full organization-level or admin access to everyone on their teams. However, there are times when certain tasks require user-level permissions to complete securely. One of the most common challenges customers face is that adding an existing Access Profile to an Application sometimes demands access that is available only at the user level. Since security is a priority, companies cannot simply hand out organization-level or L3 access to everyone.
Factors driving this limitation
-
Security Best Practices: Following the principle of “Enforcing Least Privilege” means only a few users should ever have full administrative rights. Giving Org Admin privileges to too many people increases the overall security risk.
-
Budget Constraints: The alternative is to hire a specialized L3 administrator team to handle such tasks. However, growing an L3 team just for routine operations can quickly put pressure on the IT budget.
Solution:Self-Service Workflow with Launcher & Interactive Form
To tackle this problem, a self-service workflow has been designed, built and automated which is powered by the SailPoint Launcher. Using Identity Security Cloud (ISC) Workflows, Interactive Forms, and HTTP actions, administrators can give users the required access needed without exposing sensitive administration rights. The solution hides complex, high-level API operations behind an easy-to-use interface. It allows regular users to perform specific administrative actions safely and consistently, while all the heavy lifting happens securely in the background.
How It Works
Step 1: Start with the Launcher
A user triggers the workflow through a SailPoint Launcher. An Interactive Form opens, asking them to provide the Source name.
You can directly use Source as it is already available as a predefined option type.
Step 2: Fetch Data Dynamically
Once the user submits the Source, the workflow makes a backend HTTP call to fetch all Access Profiles and Applications related to that Source.
Step 3: User Selection
A second Interactive Form then appears, showing the filtered Access Profiles and Applications. The user simply selects which Access Profile to assign and which Application to attach it to.
`For this step, create inputs for both Access Profile and Application.
In the Option Type , use ‘form inputs’ since the data will be fetched from the previous HTTP Action.`
Step 4: Secure Execution After the user submits their selection, a final HTTP request is executed automatically by the workflow. This action performs the actual task of adding the selected Access Profile to the application. The job is completed securely without requiring manual intervention from an L3 admin.
Workflow Script :
Workflow script.json (5.6 KB)
Benefits
By implementing this approach, organizations can achieve a perfect balance:
-
Uncompromised Security: The L3 and Org Admin count remains as small as possible, strictly adhering to the Principle of Least Privilege.
-
Cost Efficiency: Routine tasks are delegated safely without the need to hire additional, expensive L3 support staff.
Conclusion
Finding the sweet spot between airtight security and operational flexibility doesn’t always require expensive hires or risky compromises. By leveraging SailPoint ISC’s native capabilities like Workflows, Interactive Forms, and Launchers, one can build targeted, self-service solutions that empower your users exactly where they need it. As identity governance continues to evolve, creating these secure, extensible pathways will be key to scaling effectively.