I’m working on a requirement where I need to limit the visibility of specific Access Profiles and Applications in the Request Center so that only users who are Managers can see and request them.
I am trying to use the Segments feature for this. However, I noticed that the standard isManager attribute is not available in the dropdown criteria for building the segment. Please find attached some screeshots highlighting this out.
Note: I cannot use “Data Segmentation” for this use case, because Data Segmentation does not currently support Access Profiles and Applications.
Has anyone else encountered this limitation?
Is it normal that isManager cannot be used in Segments?
What workaround did you implement to restrict catalog visibility specifically to managers?
Any advice or best practice would be greatly appreciated!
Segments currently only seems to support attributes of type String. isManager attribute is boolean and it seems that’s why it is not listed currently. As a workaround you can create a custom attribute which populates the value as String (“true” or “false”) based on the actual value for isManager attribute and then you should be able to use that to configure your Segment.
Yes, this is expected. Segments only use mapped identity attributes, so isManager won’t appear directly in Define Segment.
Create a mapped identity attribute such as isManagerForSegment with a static transform:
{
"name": "Manager Status for Segment",
"type": "static",
"requiresPeriodicRefresh": true,
"attributes": {
"value": "$identity.getManagerStatus()"
}
}
getManagerStatus() returns whether the identity is a manager of another identity (Identity Context Examples). Once it’s populated, create the Segment with isManagerForSegment = true and add the required Access Profiles under Define Access.
Applications themselves can’t be added to Segments. Only Access Profiles, Roles, and Entitlements are supported. Also note that Org Admins bypass segmentation, and Request for Others uses the requester’s visibility, so test with a non-admin account and allow about 20 minutes for the change to take effect (Managing Access Request Segments).
