How to make Entitlement requestable "true" during AD group aggregation

Identity Security Cloud (ISC) ISC Discussion and Questions
,
1

Please consider addressing the following when creating your topic:

  • What have you tried? AD group aggregation. Entitlement created with non requestable.
  • What errors did you face (share screenshots)? requestable is false.
  • Share the details of your efforts (code / search query, workflow json etc.)?
  • What is the result you are getting and what were you expecting? During group aggregation or any auto process want to set requestable to true for all entitlements.
    There is option to make requestable to true by UI, but this manual process, i am looking auto process.
2

Hello Sandeep,
This is what I found:
By default, SailPoint ISC’s AD group aggregation does not automatically set requestable = true on imported entitlements (such as AD groups). The UI option (editing individual entitlements to set requestable = true) is manual and not scalable for large environments.

You can try this:
Since aggregation itself doesn’t have a built-in setting to mark entitlements as requestable, you can:

  • Post-aggregation rule / workflow: Set up a workflow (or rule, if supported in your tenant) that runs after aggregation and updates all entitlements where requestable = false to true.
  • API automation: Use the ISC REST API (or beta Graph API) to:
    • Search for entitlements with requestable = false
    • Update their metadata in bulk to set requestable = true

Hope this helps!!

1 Like
3

Ok.. Rule i can not use as its not straightforward deployment.

Means we have only manual option to update this attribute either via UI or API.

1 Like
4

Hi @tsandeepsTDC,

You can consider using a workflow to achieve this.

  1. Setup a WF with a scheduled trigger, running after your aggregation timing.
  2. Next step would be an HTTP action that can run a search query, fetching the entitlements marked as non-requestable. The search body would look something as below :
{
    "indices": [
        "entitlements"
    ],
    "query": {
        "fields": [
            "name"
        ],
        "query": "source.name:\"ActiveDirectory\" AND requestable:false"
    },
    "queryResultFilter": {
        "includes": [
            "id",
            "name"
        ]
    }
}
  1. Loop through each of these entitlements and then use an HTTP action inside the loop to patch each entitlement with this API to mark the entitlements as requestable.
5

Be aware loops within workflow have a limit on how many items the can have. I believe it is 250

6

Use the below API to do the change.

Body:
{
“op”: “replace”,
“path”: “/requestable”,
“value”: true
}

2 Likes
7

This topic was automatically closed 60 days after the last reply. New replies are no longer allowed.