Handle legacy entitlements which are not part of roles

Identity Security Cloud (ISC) ISC Discussion and Questions
,
5

Got it.

  1. Don’t create Access Profiles/Roles for these legacy entitlements.
  2. Remove Entitlements from Request center, it is good practice to enable access requestable through Access Profiles/Roles

Offboarding:
There is different process followed by every implementation as per their project requirements. Most commonly used is

  1. Disable user on last working day EOD or next day
  2. Remove all the access after 2/3 weeks
  3. Delete account after a month

Timelines might change, but process is heavily followed. Check this post for reference.
User Deprovisioning in Active Directory - IdentityNow (IDN) / IDN Discussion and Questions - SailPoint Developer Community Forum

Possibilities of removing access and deleting accounts:

  1. Certification campaign: launch a certification after last working day, revoke all access.
  2. Before Provisioning Rule: You can use any extension attribute or description attribute even, enable sync for that attribute. When there is a sync, Before Provisioning Rule should monitor and update the plan accordingly to remove the user access. You can delete account even using same Rule.
  3. Workflow: You can remove the access but you cannot delete account. Currently workflow Manage Accounts → Delete account supported only for Delimited source. Remember Workflow is a licensed module.

Hope this helps :slight_smile:

Thanks
Krish

3 Likes