Handling Acces Item Owner Termination in ISC

Identity Security Cloud (ISC) ISC Discussion and Questions
, ,
1

Are there any best practices for handling access item owners when they are terminated, placed on leave, or moved into a different role?

We are looking for a reliable way to quickly identify when an access item owner is no longer the appropriate owner, so we can reassign ownership to the correct identity before it becomes an issue.

So far, I have not been able to build a workflow that fully handles this. The main challenge is that determining or evaluating access item owners within workflows does not seem to work the way we need it to. Has anyone found a workaround for this?

I am also curious what methods other organizations are using to manage this. I assume we are not the first organization to run into this problem.

If there are proactive methods for addressing this, I would be very interested in those as well. Any insight, recommendations, or examples would be greatly appreciated.

At this point, I have been able to create a scheduled search that sends me a list of access item owners who are terminated or on LOA, but that does not account for changes to role code or role name. Ideally, we would like a way to detect those types of changes as well and determine whether ownership should be reviewed or reassigned.

2

Hi @jared-fox

Have you looked into the ISC Governance Connector? From what you’ve described, this is the most out of the box way to handle this use case.

This connector can handle automatic reassignments for numerous access item ownerships.

image
image606Ă—415 12.1 KB

3

@jared-fox Did you check loopback connector? Most of the clients use this for reassigning items to approapriate owner.

image
image1380Ă—510 35.7 KB

Check the below colab for more details

4

Hi we have configured in workflow if access item owner terminated we are reassigning it to his manager using workflow
Workflow.identitynow.com-Reassign Access Profile Owner to Manager-20260605-113652.json (6.6 KB)

5

This looks like it reassigns requests?

6

What’s the difference between this and the loopback connector? Both look like very interesting options to me.

7

What’s the difference between this and ISC Governance?

8

Approach:

  • Trigger a WF when the identity lifecycle state changes to Terminated.
  • Use ISC APIs to identity all access item where the terminated user is the owner.
  • Reassign ownership automatically -to the terminated users manager, Application owner or a designated fallback owner.
  • If automatic reassignment is not desired, send a notification/work item to the governance team to assign a new owner.
  • Use ISC governance connector if you want ownership transfers to be handled through provisioning .

ref: Access Profile Ownership Transfer Workflow as part of separation

9

I believe they are same thing. The ISC Governance connector is the out of the box version of that same Colab SaaS connector. I would recommend you use the OOTB version instead of any Colab based connector so you can automatically receive product updates in case SailPoint releases new functionality or bug fixes.

You can see they released the governance connector 2 months after the last commit happened on the Colab connector. Basically replacing it.
New Capability - Identity Security Cloud Governance Connector is now LIVE! - Announcements / Product News - SailPoint Developer Community