In SailPoint Identity Security Cloud (ISC), I am building a workflow to check whether the access that was approved is actually provisioned.
I can already get the list of approved entitlements (Compare A), but I’m struggling to dynamically fetch the list of entitlements that were provisioned (Compare B).
How can I dynamically populate Compare B so that I can compare both lists and verify provisioning success?
Also please let me know is it possible to compare list of values at the same time in a compare string operation in a workflow?
One possible approach is to use the Access Request Decision trigger, which is invoked whenever an access request decision occurs. Configure a filter on the trigger so it fires only for approved requests.
After that, add a Get Access action to fetch all existing entitlements for the requestedFor identity from the trigger. Finally, use Loop to iterate through the retrieved entitlements and match them against the access item provided by the trigger.
The quickes option which i can think of is, that you can try to use two workflows. First workflow will have both the values (compareA) and (compareB).
Now you can use a loop on (compareA) on which the looping will happen and pass compareB as context attribute to the loop.
From inside the workflow, make the call to next workflow which will receive the triggers like (1st, 2nd , 3rd ——- so on , elements of compareA and the list of compareB one by one).
Then use the loop here on compareB and you can then compare both the values , if any match is found then it was provisioned.
If it does not match then it was not provisioned.
I think this will solve your problem. Note, something you have handle
passing array variables in workflow as trigger might be challenge. So you will have overcome that.
If either of your compareA or compareB variables contains more than 100 elements, then please consider using the recurssion of workflows to ensure all items are processed.
I hope the information helps, please feel free to let us know if that works.