I am looking for the best approach to resolve an issue with dummy identity cubes created during an initial account aggregation.
Background:
I integrated a new application where accounts should correlate to existing employee identities (they shouldn’t have their own standalone cubes). During the initial aggregation, the correlation rule was incomplete. As a result, IIQ created dummy identity cubes and linked the accounts to them.
Troubleshooting:
I fixed the correlation rule to match the correct identities. To clean up, I re-ran the Account Aggregation task with the following settings:
Checked: Disable optimization of unchanged accounts
Disabled: Create identity if not correlated (to prevent new cubes)
The Issue:
The dummy identity cubes were not removed. Because the accounts are already linked to these dummy cubes, IIQ treats them as linked accounts and just updates them, instead of wiping the dummy cubes and re-evaluating the new correlation rule.
My Question:
What is the standard or best practice to completely remove these dummy cubes and force the accounts to re-correlate to the correct existing identities?
the accounts are already linked to the dummy identity cubes, IdentityIQ won’t evaluate the correlation rule again during aggregation. In this case, you’ll need to remove the dummy identities (provided they don’t have any valid data or other linked accounts) and then rerun Account Aggregation with Disable Optimization enabled. That allows IIQ to treat the accounts as uncorrelated and apply the updated correlation rule.
If deleting the dummy identities isn’t feasible, another option is to unlink the accounts from those identities first and then run aggregation again so the correlation logic is executed
@IslamElkhouly If you have updated the correlation logic, then running the aggregation task with option: Disable optimization of unchanged accounts checked, should update the accounts and correlate them to the right identity. In case it is not happening, please validate your correlate logic.
Once it is moved, and if there are no more account in the dummy identities, then Prune Identity Cubes task should take care of deleting the account.
You are right. This happens for accounts that already have an Identity Cube—they are correctly correlated to their existing Identity Cube.
What I was asking about is the accounts that create new Identity Cubes but do not have a corresponding identity to correlate with. How can I remove those Identity Cubes, or what is the recommended way to manage or treat them
In the aggregation task, you need to select the Disable Optimization of unchanged account option.
Run the Aggregation task after selecting this option. This will make sure all accounts are aggregated forcefully, and if there are any changes in the correlation logic, then that will be evaluated.
Even with that, if you see accounts are not correlated, then check your correlation logic once again.
Hello Islam, I would start by rerunning a full account aggregation with Disable optimization of unchanged accounts enabled, and with Only create links if they can be correlated to an existing identity enabled. That forces IIQ to process all accounts again, including unchanged accounts, after the correlation rule fix. (Account Aggregation - SailPoint IIQ)
If the updated rule now points to the correct employee identity, you should see Correlate Reassign in the aggregation task result, which means the existing account was reassigned from one identity to another during correlation.
If accounts still stay on the dummy cubes after the full aggregation, I would validate the correlation rule against a few sample accounts and confirm it returns the intended employee identity, not the dummy identity. (Correlation - SailPoint IIQ)
Once the accounts are moved to the correct identities, the dummy cubes should have no linked accounts left. At that point, run Prune Identity Cubes in analysis mode first, review what it would remove, and then run it for deletion after confirming the list looks right. The Prune task is meant for identities with no account links and no important protected references. (Pruning Identity Cubes - Compass)
@IslamElkhouly Once your correlation logic is fixed, you need to get the dummy identities with uncorrelated accounts, and delete them via IIQ Console: Delete identities in Bulk.
Then going forward run your aggregation with below options checked:
Disable optimization of unchanged accounts
Only create links if they can be correlated to an existing identity
This’ll make sure that all correlated account would be aggregated and uncorrelated ones will be skipped.
If the correlation is correct, IdentityIQ will move the account from the dummy identity to the correct identity. Once the dummy identities no longer have any account links, run the Prune Identity Cubes task (analysis first, then delete) to remove them safely.