Hello Sailors,
In our environment, it still happens that users are added to groups (for example in Entra ID) out of band.. directly in Entra ID instead of via ISC. Is there a way to assign the corresponding role to those users in ISC after the fact? Or would a better option be to remove the out-of-band accesses?
Would it make sense to have ISC automatically assign the role based on membership of the entitlement, while also keeping the role requestable? I could imagine that this approach would ensure identities are added to the role when they are assigned out of band, while still allowing users to request access through the Access Request Centre.
What would be the recommended best practice in this case?
Thanks in advance and best wishes,
Oliver
Assign corresponding role to ISC identities after out-of-band changes:
You can use Entitlements as part of the membership criteria to assign the role to the identity on out-of-band changes. This could get complex very quickly and the roles will be assigned on the role refresh taking place.
Remove out-of-band accesses:
You can enable Native Change Detection for the source and configure an ISC workflow to remove the access
However, this seems to be a process issue and ideally access provisioning/deprovisioning should be handled through ISC directly.
If you create Roles or Access Profiles with those entitlements, user will get them automatically as Roles/Access Profiles will be detected, doesn’t matter if the entitlements are added through ISC or directly at app side.
If you would like to remove them out of band access, build workflows using Native Change Detection