Identities with Role Assigned but not the corresponding entitlement

[kartheek_gopu (Kartheek Reddy Gopu)]

Hi Team,

We observed that for disconnected applications, if the Snow team is updating the tickets to “Closed Incomplete”, we see that the role is already assigned to the identity but the entitlements are not assigned and will be not retried by SailPoint.

Now, the issue is that the identity is holding the role but not the corresponding entitlements.
We want to revoke such roles assigned to various identities.

Is there any way to pull such identities who are assigned roles but not the corresponding entitlements?

Can we do this via any search query or via Workflow or Via Powershell script?

Thanks,
Kartheek

[vkashat (Vincent Kashat)]

You can use search with a query like this:

@access(id:“role id”) AND NOT @access(id:“entitlement id”)