# How to configure Entitlement/Managed Attribute descriptions to appear correctly in Certifications?

**URL:** <https://developer.sailpoint.com/discuss/t/how-to-configure-entitlement-managed-attribute-descriptions-to-appear-correctly-in-certifications/219574>\
**Category:** IIQ Discussion and Questions\
**Tags:** certifications, identityiq\
**Created:** [August 19, 2026, 9:15am UTC](https://developer.sailpoint.com/discuss/t/how-to-configure-entitlement-managed-attribute-descriptions-to-appear-correctly-in-certifications/219574 "2026-08-19T09:15:12Z")\
**Posts on this page:** 19\
**Page:** 1

<div class="post-metadata">

**Author:** ![Nureen\_Govan](https://avatars.discourse-cdn.com/v4/letter/n/b5ac83/32.png) [@Nureen\_Govan](https://developer.sailpoint.com/discuss/u/Nureen_Govan)\
**Post date:** [August 19, 2026, 9:15am UTC](https://developer.sailpoint.com/discuss/t/how-to-configure-entitlement-managed-attribute-descriptions-to-appear-correctly-in-certifications/219574/1 "2026-08-19T09:15:13Z")

</div>

## Which IIQ version are you inquiring about?

_8.3_

## Hello,

I have a question regarding how the **Description of Entitlements/Managed Attributes** is displayed in Certifications.

I have two scenarios:

**1. Delimited File Application**

I have a CSV file with the following columns:

msDS-Principal-Name | Role | Description

In the Application Schema:

- msDS-Principal-Name → Identity Attribute
- Role → Entitlement + Managed
- Description → regular attribute containing the role description

However, in the **Description field displayed in the Certification** , the entitlement value itself is displayed instead of the value from the Description column.

**2. Active Directory**

I have a similar situation with an Active Directory application connected to IdentityIQ.

In the Certification, the **Description** displayed for the entitlement is the group’s **DN** , for example:

“CN=ROLE\_FINANCE, OU=Groups,DC=company,DC=com”

However, the group in Active Directory has a description attribute, and I would like IdentityIQ to use this AD description attribute as the **Description of the Entitlement** displayed in the Certification.

Is there any configuration in the **Application Schema** or elsewhere that allows us to specify which application attribute should be used as the **Description of the Entitlement/Managed Attribute**?

What would be the recommended configuration for these two scenarios?

Thank you.

---

<div class="post-metadata">

**Author:** ![punna0001](https://sea1.discourse-cdn.com/sailpoint/discuss/user_avatar/developer.sailpoint.com/punna0001/32/42011_2.png) [@punna0001](https://developer.sailpoint.com/discuss/u/punna0001)\
**Post date:** [August 19, 2026, 9:44am UTC](https://developer.sailpoint.com/discuss/t/how-to-configure-entitlement-managed-attribute-descriptions-to-appear-correctly-in-certifications/219574/2 "2026-08-19T09:44:20Z")

</div>

Hello Nureen. I would suggest handling the two scenarios slightly differently.

**For Active Directory** , first verify that the Group Schema includes the AD `description` attribute and that its **Description Attribute** is set to `description`. Then run **Account Group Aggregation**. IdentityIQ uses the group aggregation data to populate the ManagedAttribute information used in certifications.

**For the Delimited File** , `Role` and `Description` are currently separate account attributes, so IdentityIQ does not automatically associate the Description column with the ManagedAttribute created for each Role.

The cleaner native approach would be to provide the roles as a separate **group/application-object feed** , with `Role` as the group Identity Attribute and `Description` as its Description Attribute. The account `Role` entitlement Type should match the group’s Native Object Type so IdentityIQ can associate them.

If a separate group feed is not practical, another option is to populate/import the descriptions directly into the **Entitlement Catalog**.

I would verify the resulting description in the Entitlement Catalog before generating the certification.

---

<div class="post-metadata">

**Author:** ![kannan\_sb85](https://sea1.discourse-cdn.com/sailpoint/discuss/user_avatar/developer.sailpoint.com/kannan_sb85/32/35971_2.png) [@kannan\_sb85](https://developer.sailpoint.com/discuss/u/kannan_sb85)\
**Post date:** [August 19, 2026, 11:17am UTC](https://developer.sailpoint.com/discuss/t/how-to-configure-entitlement-managed-attribute-descriptions-to-appear-correctly-in-certifications/219574/3 "2026-08-19T11:17:45Z")

</div>

@Nureen_Govan \_ I would recommand this below solution

1. Active Directory groups - Configure the AD Group Schema to use the AD group’s `description` attribute, then run a full Account Group Aggregation.
2. Delimited File: accounts plus Role and account-level Description - Add a separate role/group definition feed with one record per `role` and its `description`. Configure it as a group/application-object source.
3. Delimited File when a group feed is not possible - Import or maintain descriptions directly in the Entitlement Catalog as an interim solution.

Regards,

Kannan

---

<div class="post-metadata">

**Author:** ![Nureen\_Govan](https://avatars.discourse-cdn.com/v4/letter/n/b5ac83/32.png) [@Nureen\_Govan](https://developer.sailpoint.com/discuss/u/Nureen_Govan)\
**Post date:** [August 19, 2026, 11:53am UTC](https://developer.sailpoint.com/discuss/t/how-to-configure-entitlement-managed-attribute-descriptions-to-appear-correctly-in-certifications/219574/4 "2026-08-19T11:53:12Z")

</div>

For the delimited file: I configured `Role` as the Group Identity Attribute and `Description` as the Description Attribute, then ran the Account Group Aggregation.

The Role and Description are correctly imported, but the Description appears under **Object Properties** , while **Standard Properties → Description** remains empty.

Is there another configuration needed to make the Certification **Description** field use the imported `Description` value?

---

<div class="post-metadata">

**Author:** ![punna0001](https://sea1.discourse-cdn.com/sailpoint/discuss/user_avatar/developer.sailpoint.com/punna0001/32/42011_2.png) [@punna0001](https://developer.sailpoint.com/discuss/u/punna0001)\
**Post date:** [August 19, 2026, 1:09pm UTC](https://developer.sailpoint.com/discuss/t/how-to-configure-entitlement-managed-attribute-descriptions-to-appear-correctly-in-certifications/219574/5 "2026-08-19T13:09:36Z")

</div>

Hi Nureen. Since the Description already appears under **Object Properties** , the schema and aggregation are working correctly. The value is simply not yet being promoted into the localized ManagedAttribute description.

You may want to open the **Account Group Aggregation** task and set **Automatically promote descriptions to this locale** to your locale, for example `en_US`, then re-run the aggregation. This promotes the group’s Description into the ManagedAttribute’s localized **Standard Properties → Description** used for display in IdentityIQ.

Your Group Schema **Description Attribute = `Description`** can remain as configured, since it takes precedence over the task-level setting.

I would suggest confirming the result in the **Entitlement Catalog** before generating the certification. No rule should be needed here.

---

<div class="post-metadata">

**Author:** ![Nureen\_Govan](https://avatars.discourse-cdn.com/v4/letter/n/b5ac83/32.png) [@Nureen\_Govan](https://developer.sailpoint.com/discuss/u/Nureen_Govan)\
**Post date:** [August 19, 2026, 1:22pm UTC](https://developer.sailpoint.com/discuss/t/how-to-configure-entitlement-managed-attribute-descriptions-to-appear-correctly-in-certifications/219574/6 "2026-08-19T13:22:43Z")

</div>

I followed the suggested approach and the Managed Attribute Description is now correctly populated under Standard Properties in the Entitlement Catalog. However, I am using a Manager Certification, and the Description column in the Certification still displays the entitlement value instead of the Managed Attribute description. What configuration determines the source of the Description column in Certification?

---

<div class="post-metadata">

**Author:** ![punna0001](https://sea1.discourse-cdn.com/sailpoint/discuss/user_avatar/developer.sailpoint.com/punna0001/32/42011_2.png) [@punna0001](https://developer.sailpoint.com/discuss/u/punna0001)\
**Post date:** [August 19, 2026, 1:50pm UTC](https://developer.sailpoint.com/discuss/t/how-to-configure-entitlement-managed-attribute-descriptions-to-appear-correctly-in-certifications/219574/7 "2026-08-19T13:50:01Z")

</div>

Hello Nureen. Since the ManagedAttribute Standard Properties → Description is now populated correctly, I would first suggest generating a new Manager Certification and checking the result there. An existing certification may still reflect the data captured when it was originally generated.

If a newly generated certification still shows the entitlement value, I would then check Debug → UIConfig → uiCertificationItemWorksheetColumns and confirm the Description column is using the standard CertificationItemDescriptionColumn evaluator with IIQ\_description.

At this point, I would not change the application schema further since the ManagedAttribute description itself is already correct.

---

<div class="post-metadata">

**Author:** ![Nureen\_Govan](https://avatars.discourse-cdn.com/v4/letter/n/b5ac83/32.png) [@Nureen\_Govan](https://developer.sailpoint.com/discuss/u/Nureen_Govan)\
**Post date:** [August 19, 2026, 2:23pm UTC](https://developer.sailpoint.com/discuss/t/how-to-configure-entitlement-managed-attribute-descriptions-to-appear-correctly-in-certifications/219574/8 "2026-08-19T14:23:33Z")

</div>

The **uiCertificationItemWorksheetColumns configuration** is already using CertificationItemDescriptionColumn with IIQ\_description.  
Result:

```auto
<ColumnConfig dataIndex="description" evaluator="sailpoint.web.view.certification.CertificationItemDescriptionColumn" groupProperty="IIQ_description" headerKey="cert_item_tbl_header_description" hideable="true" minWidth="250" percentWidth="50" property="IIQ_description" renderer="spMoreLessToggleColumn" sortProperty="IIQ_description" stateId="description"/>"

```

However, a newly generated Manager Certification still displays the entitlement value in the Description column. Where is IIQ\_description populated for the CertificationItem, and what could cause it to contain the entitlement value instead of the ManagedAttribute description?

---

<div class="post-metadata">

**Author:** ![mkumariaas](https://sea1.discourse-cdn.com/sailpoint/discuss/user_avatar/developer.sailpoint.com/mkumariaas/32/40387_2.png) [@mkumariaas](https://developer.sailpoint.com/discuss/u/mkumariaas)\
**Post date:** [August 20, 2026, 4:05am UTC](https://developer.sailpoint.com/discuss/t/how-to-configure-entitlement-managed-attribute-descriptions-to-appear-correctly-in-certifications/219574/9 "2026-08-20T04:05:02Z")

</div>

you have multiple diff kind of certification and their catagory so if you want to update the change do it for all or if you want specific then u can do.  
Related to decription is not showing with AD description in entitlement catalog that use ootb feature set description attribute if that is not working then use group refresh rule and from there you can do.

---

<div class="post-metadata">

**Author:** ![Nureen\_Govan](https://avatars.discourse-cdn.com/v4/letter/n/b5ac83/32.png) [@Nureen\_Govan](https://developer.sailpoint.com/discuss/u/Nureen_Govan)\
**Post date:** [August 21, 2026, 9:09am UTC](https://developer.sailpoint.com/discuss/t/how-to-configure-entitlement-managed-attribute-descriptions-to-appear-correctly-in-certifications/219574/10 "2026-08-21T09:09:57Z")

</div>

Hi,

I followed the suggested approach and it worked — the ManagedAttribute now has the correct Description under Standard Properties.

I also noticed that, when viewing the entitlement under an Identity, the Role is displayed as plain text and is not clickable. This may be expected behavior for a Delimited application, so I’m not assuming this is an issue.

**Is there any additional configuration I may be missing in the Application/Group Schema to ensure that the ManagedAttribute Description is correctly displayed in the Manager Certification?**

---

<div class="post-metadata">

**Author:** ![santhirajumunganda](https://sea1.discourse-cdn.com/sailpoint/discuss/user_avatar/developer.sailpoint.com/santhirajumunganda/32/42744_2.png) [@santhirajumunganda](https://developer.sailpoint.com/discuss/u/santhirajumunganda)\
**Post date:** [August 23, 2026, 1:45pm UTC](https://developer.sailpoint.com/discuss/t/how-to-configure-entitlement-managed-attribute-descriptions-to-appear-correctly-in-certifications/219574/11 "2026-08-23T13:45:04Z")

</div>

Please try running a full refresh and then create a new certification to check if the descriptions are showing

---

<div class="post-metadata">

**Author:** ![neel193](https://sea1.discourse-cdn.com/sailpoint/discuss/user_avatar/developer.sailpoint.com/neel193/32/34038_2.png) [@neel193](https://developer.sailpoint.com/discuss/u/neel193)\
**Post date:** [August 24, 2026, 8:11am UTC](https://developer.sailpoint.com/discuss/t/how-to-configure-entitlement-managed-attribute-descriptions-to-appear-correctly-in-certifications/219574/12 "2026-08-24T08:11:48Z")

</div>

@Nureen_Govan Could you please share screenshot of the part you are talking about? Entitlements are clickable if the respective managed attribute object is available in the system.

---

<div class="post-metadata">

**Author:** ![Nureen\_Govan](https://avatars.discourse-cdn.com/v4/letter/n/b5ac83/32.png) [@Nureen\_Govan](https://developer.sailpoint.com/discuss/u/Nureen_Govan)\
**Post date:** [August 28, 2026, 1:14pm UTC](https://developer.sailpoint.com/discuss/t/how-to-configure-entitlement-managed-attribute-descriptions-to-appear-correctly-in-certifications/219574/13 "2026-08-28T13:14:21Z")

</div>

Hi,

Finally, I managed to get the Description to appear in the certification, but only after manually adding the **Attribute** field of the ManagedAttribute to Role.

I checked the ManagedAttribute in Debug and noticed that it is being created with the correct **Value** and **Description** , but the **Attribute field is not being populated (it remains null/empty)**.

After manually setting Attribute = Role, the Description appeared correctly in the certification.

So it seems the issue is related to the **ManagedAttribute not receiving the Attribute (Role) during aggregation**, rather than the certification or the Description itself.

Could you please help me understand **why the Attribute is not being populated automatically for a Delimited File application during aggregation** , if there is any additional configuration required for the Group Schema?

---

<div class="post-metadata">

**Author:** ![neel193](https://sea1.discourse-cdn.com/sailpoint/discuss/user_avatar/developer.sailpoint.com/neel193/32/34038_2.png) [@neel193](https://developer.sailpoint.com/discuss/u/neel193)\
**Post date:** [August 28, 2026, 1:33pm UTC](https://developer.sailpoint.com/discuss/t/how-to-configure-entitlement-managed-attribute-descriptions-to-appear-correctly-in-certifications/219574/14 "2026-08-28T13:33:25Z")

</div>

@Nureen_Govan I believe Role is your delimited application attribute that stores access information, not the IIQ Roles. Please confirm.

Could you please share your app xml and one of the entitlement xml where attribute=role is not set? Normally attribute should be set if you map the group attribut to one of the account schema attribute. So, please validate your account schema and in case it doesn’t work, please share the xmls.

---

<div class="post-metadata">

**Author:** ![Nureen\_Govan](https://avatars.discourse-cdn.com/v4/letter/n/b5ac83/32.png) [@Nureen\_Govan](https://developer.sailpoint.com/discuss/u/Nureen_Govan)\
**Post date:** [August 28, 2026, 1:46pm UTC](https://developer.sailpoint.com/discuss/t/how-to-configure-entitlement-managed-attribute-descriptions-to-appear-correctly-in-certifications/219574/15 "2026-08-28T13:46:45Z")

</div>

> [@neel193](#):
>
> I believe Role is your delimited application attribute that stores access information, not the IIQ Roles. Please confirm.
> 
> Could you please share your app xml and one of the entitlement xml where attribute=role is not set? Normally attribute should be set if you map the group attribut to one of the account schema attribute. So, please validate your account schema and in case it doesn’t work, please share the xmls.

yes, “Role” is the attribute in my Delimited File application that stores the access information.  
Entitlement XML:

```auto
<ManagedAttribute aggregated="true" created="1787910211350" hash="d465aa29486fc5273253dc613bdc13380488d8e5" id="0a071b11980e1db381a047c0c7164684" lastRefresh="1787913852860" modified="1787913852860" type="Group" value="DB_Reader">
  <ApplicationRef>
    <Reference class="sailpoint.object.Application" id="0a021b11980e1db381a047be764e4657" name="DB"/>
  </ApplicationRef>
  <Attributes>
    <Map>
      <entry key="Description" value="Permission to Read DataBase"/>
      <entry key="sysDescriptions">
        <value>
          <Map>
            <entry key="en_US" value="Permission to Read DataBase"/>
          </Map>
        </value>
      </entry>
    </Map>
  </Attributes>
</ManagedAttribute>

```

APP XML:

```auto
<Schemas>
    <Schema created="1787910059598" displayAttribute="" id="0a021b11980e1db381a047be764e4659" identityAttribute="Name" instanceAttribute="" modified="1787920885924" nativeObjectType="account" objectType="account" permissionsRemediationModificationType="None">
      <AttributeDefinition name="Name" type="string">
        <Description></Description>
      </AttributeDefinition>
      <AttributeDefinition entitlement="true" managed="true" multi="true" name="Role" schemaObjectType="Group" type="string">
        <Description></Description>
      </AttributeDefinition>
    </Schema>
    <Schema aggregationType="group" created="1787912417167" descriptionAttribute="Description" displayAttribute="" id="0a021b11980e1db381a047e26f8f4897" identityAttribute="Role" instanceAttribute="" modified="1787920885924" nativeObjectType="Group" objectType="Group" permissionsRemediationModificationType="None">
      <AttributeDefinition name="Role" type="string">
        <Description></Description>
      </AttributeDefinition>
      <AttributeDefinition name="Description" type="string">
        <Description></Description>
      </AttributeDefinition>
    </Schema>
  </Schemas>

```

---

<div class="post-metadata">

**Author:** ![neel193](https://sea1.discourse-cdn.com/sailpoint/discuss/user_avatar/developer.sailpoint.com/neel193/32/34038_2.png) [@neel193](https://developer.sailpoint.com/discuss/u/neel193)\
**Post date:** [August 28, 2026, 1:49pm UTC](https://developer.sailpoint.com/discuss/t/how-to-configure-entitlement-managed-attribute-descriptions-to-appear-correctly-in-certifications/219574/16 "2026-08-28T13:49:13Z")

</div>

@Nureen_Govan Have you ran the aggregation after adding the schemas?

---

<div class="post-metadata">

**Author:** ![Nureen\_Govan](https://avatars.discourse-cdn.com/v4/letter/n/b5ac83/32.png) [@Nureen\_Govan](https://developer.sailpoint.com/discuss/u/Nureen_Govan)\
**Post date:** [August 28, 2026, 1:51pm UTC](https://developer.sailpoint.com/discuss/t/how-to-configure-entitlement-managed-attribute-descriptions-to-appear-correctly-in-certifications/219574/17 "2026-08-28T13:51:18Z")

</div>

> [@neel193](#):
>
> Have you ran the aggregation after adding the schemas?

Yes, I have run the aggregation after adding the schemas.

The **Account Aggregation** completes successfully. However, when I run the **Account Group Aggregation** , it fails with the following error for each entitlement:

`org.hibernate.exception.ConstraintViolationException: could not execute statement`

So the Account Aggregation is working successfully, but the Account Group Aggregation is failing with the constraint violation.

---

<div class="post-metadata">

**Author:** ![neel193](https://sea1.discourse-cdn.com/sailpoint/discuss/user_avatar/developer.sailpoint.com/neel193/32/34038_2.png) [@neel193](https://developer.sailpoint.com/discuss/u/neel193)\
**Post date:** [August 28, 2026, 1:52pm UTC](https://developer.sailpoint.com/discuss/t/how-to-configure-entitlement-managed-attribute-descriptions-to-appear-correctly-in-certifications/219574/18 "2026-08-28T13:52:53Z")

</div>

@Nureen_Govan Please delete all managed attributes for this app and try running the aggregations. Seems your entitlements are not properly created.

---

<div class="post-metadata">

**Author:** ![Nureen\_Govan](https://avatars.discourse-cdn.com/v4/letter/n/b5ac83/32.png) [@Nureen\_Govan](https://developer.sailpoint.com/discuss/u/Nureen_Govan)\
**Post date:** [August 28, 2026, 2:05pm UTC](https://developer.sailpoint.com/discuss/t/how-to-configure-entitlement-managed-attribute-descriptions-to-appear-correctly-in-certifications/219574/19 "2026-08-28T14:05:28Z")

</div>

Thanks for your help! I deleted the existing entitlements from the catalog and ran the aggregation again, and it worked as expected.