Hiding EntraID entitlements that are synchronized with OnPrem AD

IdentityIQ (IIQ) IIQ Discussion and Questions
,
1

Which IIQ version are you inquiring about?

IIQ 8.3

We are in the process of connecting our IIQ instance to EntraID. We have many groups already in IIQ from our AD instance that are also sync’d to EntraID. We don’t want to import those groups into IIQ as it will cause confusion for users when they see duplicates.

However, not importing the groups adds a bunch of entitlements to the account that are just GUIDs, making it a mess to look at in the Access page and in the remove page for manage user access

Is there a way to tell IIQ to only show entitlements that are in IIQ?

If not, is there a way we can avoid the EntraID aggregation from pulling in groups that are synchronized with our onprem AD?

Thank you.

2

if you can use advanced filter to read the property onPremisesSyncEnabled

3

Thanks. We can read that value and use it to make sure the onprem groups don’t get sync’d by the group aggregation. How could I use that in the user agg to block it from adding the entitlements to the cube? I appreciate the help!

4

can you try below for “Group Membership Filter“.

onPremisesSyncEnabled ne false

if this wont work, then you may have to use customization rule during ent’ aggregation to force the filter.