Hi All,
Anyone know a way to grant access to users without going through the request center. The downstream source is Active Directory, so an entitlement or access profile would sufice.
We have multiple hierarchy groups for an application in our environment and a requirement to add all employees to the least group in the hierarchy at onboarding but contractors have to get any of those groups by requesting them in the request center after the access is approved. Contractors access if fine. No problem :).
For employees however, it made perfect sense at first to put the least hierarchy group into the birthright role for employees.
The issue is that, users might get upgrade to higher hierarchy group down the line and they need to be removed from that group and then added to the next level group higher up the hierarchy. They cannot be in multiple hierarchy groups at once as that breaks the application.
Having user be in only one group at any point in time means we cannot use birthright groups for this.
Secondly, there’s a number of these sort of groups in the environment and I prefer not to have a roles created for every one of them as it doesnt make sense to have a role with only one entitlement in each of them.
Thirdly, since we want the least of these groups assigned at onboarding, we dont want any approvals fired off for employees. Request center wont work for this third requirement as contractors can abuse it and get unapproved access.
In summary, is there any automated way to grant employees birthright access to entitlement or access profiles without using roles and without requiring any sort of approval workflow? It’s very important to not have employees going to request center for this.
Thank you for you input.