I have a question regarding how the Description of Entitlements/Managed Attributes is displayed in Certifications.
I have two scenarios:
1. Delimited File Application
I have a CSV file with the following columns:
msDS-Principal-Name | Role | Description
In the Application Schema:
msDS-Principal-Name → Identity Attribute
Role → Entitlement + Managed
Description → regular attribute containing the role description
However, in the Description field displayed in the Certification, the entitlement value itself is displayed instead of the value from the Description column.
2. Active Directory
I have a similar situation with an Active Directory application connected to IdentityIQ.
In the Certification, the Description displayed for the entitlement is the group’s DN, for example:
“CN=ROLE_FINANCE, OU=Groups,DC=company,DC=com”
However, the group in Active Directory has a description attribute, and I would like IdentityIQ to use this AD description attribute as the Description of the Entitlement displayed in the Certification.
Is there any configuration in the Application Schema or elsewhere that allows us to specify which application attribute should be used as the Description of the Entitlement/Managed Attribute?
What would be the recommended configuration for these two scenarios?
Hello Nureen. I would suggest handling the two scenarios slightly differently.
For Active Directory, first verify that the Group Schema includes the AD description attribute and that its Description Attribute is set to description. Then run Account Group Aggregation. IdentityIQ uses the group aggregation data to populate the ManagedAttribute information used in certifications.
For the Delimited File, Role and Description are currently separate account attributes, so IdentityIQ does not automatically associate the Description column with the ManagedAttribute created for each Role.
The cleaner native approach would be to provide the roles as a separate group/application-object feed, with Role as the group Identity Attribute and Description as its Description Attribute. The account Role entitlement Type should match the group’s Native Object Type so IdentityIQ can associate them.
If a separate group feed is not practical, another option is to populate/import the descriptions directly into the Entitlement Catalog.
I would verify the resulting description in the Entitlement Catalog before generating the certification.
@Nureen_Govan _ I would recommand this below solution
Active Directory groups - Configure the AD Group Schema to use the AD group’s description attribute, then run a full Account Group Aggregation.
Delimited File: accounts plus Role and account-level Description - Add a separate role/group definition feed with one record per role and its description. Configure it as a group/application-object source.
Delimited File when a group feed is not possible - Import or maintain descriptions directly in the Entitlement Catalog as an interim solution.
For the delimited file: I configured Role as the Group Identity Attribute and Description as the Description Attribute, then ran the Account Group Aggregation.
The Role and Description are correctly imported, but the Description appears under Object Properties, while Standard Properties → Description remains empty.
Is there another configuration needed to make the Certification Description field use the imported Description value?
Hi Nureen. Since the Description already appears under Object Properties, the schema and aggregation are working correctly. The value is simply not yet being promoted into the localized ManagedAttribute description.
You may want to open the Account Group Aggregation task and set Automatically promote descriptions to this locale to your locale, for example en_US, then re-run the aggregation. This promotes the group’s Description into the ManagedAttribute’s localized Standard Properties → Description used for display in IdentityIQ.
Your Group Schema Description Attribute = Description can remain as configured, since it takes precedence over the task-level setting.
I would suggest confirming the result in the Entitlement Catalog before generating the certification. No rule should be needed here.
I followed the suggested approach and the Managed Attribute Description is now correctly populated under Standard Properties in the Entitlement Catalog. However, I am using a Manager Certification, and the Description column in the Certification still displays the entitlement value instead of the Managed Attribute description. What configuration determines the source of the Description column in Certification?
Hello Nureen. Since the ManagedAttribute Standard Properties → Description is now populated correctly, I would first suggest generating a new Manager Certification and checking the result there. An existing certification may still reflect the data captured when it was originally generated.
If a newly generated certification still shows the entitlement value, I would then check Debug → UIConfig → uiCertificationItemWorksheetColumns and confirm the Description column is using the standard CertificationItemDescriptionColumn evaluator with IIQ_description.
At this point, I would not change the application schema further since the ManagedAttribute description itself is already correct.
However, a newly generated Manager Certification still displays the entitlement value in the Description column. Where is IIQ_description populated for the CertificationItem, and what could cause it to contain the entitlement value instead of the ManagedAttribute description?
you have multiple diff kind of certification and their catagory so if you want to update the change do it for all or if you want specific then u can do.
Related to decription is not showing with AD description in entitlement catalog that use ootb feature set description attribute if that is not working then use group refresh rule and from there you can do.