I am looking for the best approach to resolve an issue with dummy identity cubes created during an initial account aggregation.
Background:
I integrated a new application where accounts should correlate to existing employee identities (they shouldn’t have their own standalone cubes). During the initial aggregation, the correlation rule was incomplete. As a result, IIQ created dummy identity cubes and linked the accounts to them.
Troubleshooting:
I fixed the correlation rule to match the correct identities. To clean up, I re-ran the Account Aggregation task with the following settings:
Checked: Disable optimization of unchanged accounts
Disabled: Create identity if not correlated (to prevent new cubes)
The Issue:
The dummy identity cubes were not removed. Because the accounts are already linked to these dummy cubes, IIQ treats them as linked accounts and just updates them, instead of wiping the dummy cubes and re-evaluating the new correlation rule.
My Question:
What is the standard or best practice to completely remove these dummy cubes and force the accounts to re-correlate to the correct existing identities?
the accounts are already linked to the dummy identity cubes, IdentityIQ won’t evaluate the correlation rule again during aggregation. In this case, you’ll need to remove the dummy identities (provided they don’t have any valid data or other linked accounts) and then rerun Account Aggregation with Disable Optimization enabled. That allows IIQ to treat the accounts as uncorrelated and apply the updated correlation rule.
If deleting the dummy identities isn’t feasible, another option is to unlink the accounts from those identities first and then run aggregation again so the correlation logic is executed
@IslamElkhouly If you have updated the correlation logic, then running the aggregation task with option: Disable optimization of unchanged accounts checked, should update the accounts and correlate them to the right identity. In case it is not happening, please validate your correlate logic.
Once it is moved, and if there are no more account in the dummy identities, then Prune Identity Cubes task should take care of deleting the account.
You are right. This happens for accounts that already have an Identity Cube—they are correctly correlated to their existing Identity Cube.
What I was asking about is the accounts that create new Identity Cubes but do not have a corresponding identity to correlate with. How can I remove those Identity Cubes, or what is the recommended way to manage or treat them
In the aggregation task, you need to select the Disable Optimization of unchanged account option.
Run the Aggregation task after selecting this option. This will make sure all accounts are aggregated forcefully, and if there are any changes in the correlation logic, then that will be evaluated.
Even with that, if you see accounts are not correlated, then check your correlation logic once again.
Hello Islam, I would start by rerunning a full account aggregation with Disable optimization of unchanged accounts enabled, and with Only create links if they can be correlated to an existing identity enabled. That forces IIQ to process all accounts again, including unchanged accounts, after the correlation rule fix. (Account Aggregation - SailPoint IIQ)
If the updated rule now points to the correct employee identity, you should see Correlate Reassign in the aggregation task result, which means the existing account was reassigned from one identity to another during correlation.
If accounts still stay on the dummy cubes after the full aggregation, I would validate the correlation rule against a few sample accounts and confirm it returns the intended employee identity, not the dummy identity. (Correlation - SailPoint IIQ)
Once the accounts are moved to the correct identities, the dummy cubes should have no linked accounts left. At that point, run Prune Identity Cubes in analysis mode first, review what it would remove, and then run it for deletion after confirming the list looks right. The Prune task is meant for identities with no account links and no important protected references. (Pruning Identity Cubes - Compass)
@IslamElkhouly Once your correlation logic is fixed, you need to get the dummy identities with uncorrelated accounts, and delete them via IIQ Console: Delete identities in Bulk.
Then going forward run your aggregation with below options checked:
Disable optimization of unchanged accounts
Only create links if they can be correlated to an existing identity
This’ll make sure that all correlated account would be aggregated and uncorrelated ones will be skipped.
If the correlation is correct, IdentityIQ will move the account from the dummy identity to the correct identity. Once the dummy identities no longer have any account links, run the Prune Identity Cubes task (analysis first, then delete) to remove them safely.
Once the accounts correalted to proper identity later run the Prune Identity Cubes. It will automatically delete orphan identities who don’t have any links.
Hi @IslamElkhouly I would suggest a simple option to overcome this situation. If you do not have any RBAC enabled for this application, make the filter empty in the aggregation. Select the Detect Delete option as true, and then run the aggregations. Links will be removed from the identity. Then, run the pure identity task, it will remove the identity. You can then run a full aggregation with the option Disabled: Create identity if not correlated (to prevent new cubes), which you mentioned. This approach is only recommended if your application does not have RBAC auto-assignment enabled.
Yes, I’m still facing the issue, but I think most of the replies misunderstood my question and focused on the correlation rule.
The correlation rule is working correctly. The problem is that I initially had the “Only create links for existing identities” option disabled. As a result, many Identity Cubes were created automatically, and these cubes are not correlated with any existing identity.
Any account that has a matching identity is correlated correctly. My issue is with the accounts that don’t have a corresponding identity—they created new Identity Cubes automatically.
I need a way to remove these orphan Identity Cubes in bulk, not one by one.
Basically you need to run a query or generate a report to know how many uncorrelated accounts exist in the system along with their dummy identities. Then you need to delete these identities.
Here is a sample query and report to get the application user account report:
You can modify the query to add correlated=false (please make adjustments as per your requirements)
SELECT
idObj.id as "UnCorrelatedDummyIds",
idObj.name AS "InactiveIdentityName",
idObj.display_name AS "DisplayName",
idObj.email AS "Email",
appObj.name AS "AppName",
linkObj.native_identity AS "ActiveAccountID"
FROM spt_link linkObj
JOIN spt_application appObj ON linkObj.application = appObj.id
JOIN spt_identity idObj ON linkObj.identity_id = idObj.id
WHERE linkObj.iiq_disabled = 0
AND idObj.inactive = 1
AND idObj.correlated = 0
This query will give you all dummy identities, which you can delete using IIQ Console (link already shared in previous response).
Thanks. I created a simple customization rule that returns null, then ran aggregation with the Detect Deleted Accounts option enabled. After that, I executed the Prune Identity Cubes task to remove those identity cubes, and finally ran the aggregation again with the Create Links Only option enabled.
My question is: if RBAC is already configured, what would be the impact of performing these steps?
Hi @IslamElkhouly Good question. If you write business role assignment logic to provision other applications based on this logic, they will be deprovisioned. This would impact those use cases. I think you should be good.