I have a business role that assigns an IT role to a group of users.The IT role is going to be modified to assign additional entitlements.
Is there a way for this change to be automatically applied to the group of users who have the business role?
Currently, we have to perform a refresh on that group of users for the changes to take effect. Ideally, we would like a mechanism so that if an IT role is modified, the changes are automatically applied to the necessary users without further intervention.
Edit: Another option could be adding a new IT Role to the Bussines Role, but don´t know if there is any way to provision automatically to users with the Bussiness Role
I don’t think there any automated way of provisioning entitlements when IT role composition is changed. It should be either by Role Propagation task which records all role composition changes and processes it or Refresh identity task with provision assignments checked.
Another option could be adding a new IT Role to the Bussines Role, but don´t know if that would provision automatically to users with the Bussiness Role
@jvicente You need identity refresh to sync the entitlement changes on the users.
However, you can try modifying the workflow associated with role changes. It’ll have the role metadata: current and new changes. You can check if the change is for entitlements, get the list of users who has role assigned, then launch the identity refresh task on those users from the workflow itself. In that way you don’t need to launch it manually.
If you are updating role through SailPoint UI, then there is a RoleChangeEvent object gets generated, this can be viewed in Debug page. For this you need to allow Role changes to be propagated option in Global Settings.
Once the RoleChangeEvent is generated then SailPoint’s Role Propagation task will take care of adding or removing entitlements based on the changes in the IT roles.
Otherwise, second option is to run the refresh of the users with required options selected.
You need to enable the role propagation in Global Settings. Gear → Global Settings → IdentityIQ Configuration → Roles → Enable Allow propagation of role changes.
Now create a Task of type Propagate Role Changes in Setup ->Tasks and execute the task to propagate the changes made to the roles to identity.
However, the role propagation does not happen automatically when a role is modified. So, you can schedule this task to propagate role changes on a scheduled basis to identities.
Hi @jvicente If role updates need to be automatically reflected to users, you can also consider using the “Role Modeler - Impact Analysis” workflow. Instead of modifying the default workflow directly, create a copy and rename it. In the copied workflow, add a refresh step with appropriate refresh arguments and use a step condition so it executes only during role update operations. As Venkata Rajyalakshmi mentioned, this approach works well for automatic propagation after role changes.
Hi @sukarande , I feel like propagation task will get performance issue of the system , Please follow below steps setup delta changes.
If automatic propagation is disabled due to performance concerns in your environment, the standard approach is to schedule a targeted daily task.
Create a Dedicated Task: Set up an Identity Refresh task.
Uncheck All Rules Except One: Uncheck everything except “Refresh role assignments” (and check “Provision assignments”).
Set to Daily/Hourly: Run this short, lightweight “delta” task frequently. It will only process users with pending role changes, meaning it won’t impact system performance like a full global refresh.
It will not happen immediately/automatically; once the refresh task runs with the Refresh assigned roles and Provision assignments options, it will update the users.
It’s been a while since I’ve seen you here in the IIQ community!
Just to clarify, I believe the original question is asking whether the update happens without running any tasks. My understanding is that IdentityIQ will not automatically recalculate and update assigned roles or provisioning assignments unless an Identity Refresh is triggered (either manually, through a scheduled task, or via another process that invokes the refresh).
So, in the scenario where no refresh task is executed, I wouldn’t expect the changes to be reflected on the identities.
Could you confirm if there is any OOTB mechanism that would update users without an Identity Refresh?