How to retrieve the email attribute from the ProvisioningPlan during an Add Entitlement operation?

[trettkowski (Tyler Rettkowski)]

Hi @tainam-nascimento

I’m afraid there’s no easy out of the box solution for this since you need both attributes and you simply cannot set both of them to be your native Identity attribute.

@tainam-nascimento

In another project with a similar requirement, we worked around this by making a call to the SailPoint ISC Search API to locate the corresponding identity and retrieve its email address. However, before following the same approach again, I would like to understand whether there is a more appropriate solution using the ProvisioningPlan, a Provisioning Policy, or another object/context already available to the Web Services Before Operation Rule.

I would never suggest you to do this since you will need two separate credentials to manage inside the one connector and can get messy quickly.

The widely accepted solution to this is using a cloud before provisioning rule. This will allow you to add identity attributes to your provisioning plan. This post outlines exactly how to do that:
Pass Non-Provisioned Attributes from Before Provision rule to Connector Rules - Content / Community Blog - SailPoint Developer Community