Governance Group as Entitlement Owner in ISC Governance Connector

Identity Security Cloud (ISC) ISC Discussion and Questions
1

I am using the Identity Security Cloud Governance Connector and aggregating Governance Groups as entitlements.

Is there a way to automatically set the Governance Group (or its owner) as the Entitlement Owner during aggregation? Currently, I can see the entitlement being created, but the ownership is not being populated as expected.

Has anyone implemented this requirement or found a recommended approach?

Thanks in advance!

2

@ROHPU Not directly during aggregation, as far as the standard ISC Governance Connector behavior goes.

When you aggregate Governance Groups as entitlements, SailPoint can create the entitlement records, but it does not automatically take the Governance Group owner and make that person the Entitlement Owner.

So, in simple terms: Governance Group ownership and Entitlement ownership are two different things in ISC. Just because a person owns the Governance Group does not mean SailPoint will automatically make them the owner of the entitlement created from that group.

If you need this to happen automatically, you would generally need some custom automation, for example using ISC APIs/workflows or another post-processing approach to:

Governance Group aggregated → Find Governance Group owner → Find corresponding entitlement → Update entitlement owner

3

Okay, thanks. I was exploring whether anyone has implemented a best-practice approach for this use case. It would be helpful to know if there are any recommended patterns or solutions that others are using in ISC.

4

Hi Rohan, There is no native way to do that during the aggregation of the governance groups.

5

The Governance Connector does not currently provide an out-of-the-box option to automatically map a Governance Group owner as the Entitlement Owner during entitlement aggregation.

You can consider these approaches:

  • Use an Entitlement Attribute Sync or post-aggregation process to populate the entitlement owner based on the Governance Group owner.
  • Leverage the Entitlements API to update entitlement ownership after aggregation.
  • If the Governance Group owner is available as an aggregated entitlement attribute, create automation (Workflow/API process) to read that attribute and assign the corresponding entitlement owner.

In most implementations, entitlement ownership is managed separately after aggregation rather than being automatically inherited from the Governance Group owner during the aggregation process.

6

Thanks for the suggestion. Could you please elaborate on the Entitlement Attribute Sync approach? How would you use it to map the Governance Group owner as the Entitlement Owner after aggregation?