Identity Attributes Changes not Logged in Access History

Identity Security Cloud (ISC) ISC Discussion and Questions
1

:bangbang: Please be sure you’ve read the docs and API specs before asking for help. Also, please be sure you’ve searched the forum for your answer before you create a new topic.

I had a case where changes to my identity attributes weren’t logged in Access History, and because of that, I believe my workflow was not triggered!

My “Work Email” attribute in the identity profile has a First Valid transform, which, at first, sets a default value for newly created identities. After the AD account creation, it gets the UPN value that was generated by a rule (standard pattern).

Today, while running a few tests with 200 accounts, I came across 20 accounts where the Work Email attribute was changed, but I couldn’t find the logs in the Access History.

And then I found this article: https://support.sailpoint.com/csm/en/identity-attribute-update-not-showing-in-identity-history-or-search?id=kb_article&sys_id=091e8f3e33e96e908413a5373e5c7b53, which, for me, is really odd. After a few tests, it turned out not to be true!

I made tests with attributes that trigger provisioning actions and attributes that doesn`t, both cases were logged!

Has anyone come across this “issue”? This is the first time I’ve seen this, and it worries me a little bit.:sweat_smile:

2

Hello Yan,

Yes, I have also come across cases when specifically AD-provisioning and sync jobs are not logged in ISC.

Are you seeing the changes in the VA?

Are you seeing the changes on the IQService host?

If not:

You could apply an AfterModify script to your AD-connector just to get the provisioning plans stored on sync. Here you can also filter on the Work Email attribute for example if that’s specifically what you want to log.