Identity Event “Provision to null” Created Without Link – Delimited Application

IdentityIQ (IIQ) IIQ Discussion and Questions
, , ,
1

Hi Team,

I’ve configured a Delimited Application to be requestable via Access Request. When I submit a request, an Identity Event is generated, and it shows the following details (see attached screenshot):

  • Summary: Provision to null
  • Due On: A future date (e.g., Jul 28, 2025 in my example)

Screenshot 2025-06-29 at 11.59.15 AM
Screenshot 2025-06-29 at 11.59.15 AM2504×176 94.4 KB

However:

  • The event persists even after the Due On date has passed.
  • No link gets created or provisioned for the user.

Has anyone encountered this behavior before?

  • Is this expected for delimited apps?
  • Could this be due to missing provisioning configuration or mappings?
  • What steps can I take to troubleshoot why the event is generated but no provisioning action happens?

Any insights or guidance would be much appreciated.

Thanks in advance!

2

Hi
Delimited connectors are non-provisionable by default — they are typically used for aggregation-only (e.g., syncing from a CSV file). However, IIQ still supports provisioning through identity events or custom rules, but only if these are explicitly configured.

“Provision to null” means:

The provisioning plan is missing the application attribute or the application itself is not configured with a provisioning rule, so IdentityIQ doesn’t know where or how to send the provisioning request.
But Yes, Delimited Apps can be provisioned, but only when a provisioning rule and mappings are in place. The event you’re seeing (Provision to null) is a signal that IdentityIQ didn’t know where to send the request.

Maybe You can try check below:

Checkpoint Expected
Application marked Allow Provisioning Yes
Provisioning Mappings exist Yes (identity → account attributes)
Delimited File Provisioning Rule Yes, not empty
Identity Event application not null Shows correct application
AccountRequest created in plan Target app, operation = Create/Modify

If you can just check with this Provisoning Rule as well:

`import sailpoint.object.*;
    import sailpoint.tools.*;

    // This is the output writer to write lines to the file
    BufferedWriter writer = (BufferedWriter) arguments.get("writer");

    // The provisioning plan
    ProvisioningPlan plan = (ProvisioningPlan) arguments.get("plan");

    // Simple CSV header format: username,email,entitlement
    if (plan != null && plan.getAccountRequests() != null) {
        for (AccountRequest acctReq : plan.getAccountRequests()) {
            String operation = acctReq.getOperation();
            String nativeIdentity = acctReq.getNativeIdentity();

            Map attributes = acctReq.getAttributes();

            // Example: fetch values from attributes
            String email = attributes.containsKey("email") ? attributes.get("email").toString() : "";
            String entitlement = attributes.containsKey("entitlement") ? attributes.get("entitlement").toString() : "";

            // Construct a CSV line (adjust format as needed)
            String csvLine = nativeIdentity + "," + email + "," + entitlement;

            // Write to file
            writer.write(csvLine);
            writer.newLine();
        }
    }
    return plan;`
3

@uditsahntl01 ,

Thank you for your explanation and response, as far as plan is concerned below is the plan created:

  <AccountRequest application="Test Portal" op="Modify">
    <Attributes>
      <Map>
        <entry key="attachmentConfigList"/>
        <entry key="attachments"/>
        <entry key="id" value="64553d1e97b114808197b9aa7f3c6ffe"/>
      </Map>
    </Attributes>
    <AttributeRequest assignmentId="54dd9667b28c4460a768b8a92e87c863" displayValue="Test Portal - Worker" name="Role" op="Add" value="Test Portal - Worker">
      <Attributes>
        <Map>
          <entry key="assignment" value="true"/>
          <entry key="comments" value="test"/>
        </Map>
      </Attributes>
    </AttributeRequest>
  </AccountRequest>
  <Attributes>
    <Map>
      <entry key="source" value="LCM"/>
    </Map>
  </Attributes>
  <ProvisioningTargets>
    <ProvisioningTarget application="RAS Portal" assignmentId="54dd9667b28c4460a768b8a92e87c863" attribute="Role" value="Test Portal - Worker">
      <AccountSelection applicationId="64553d6497a81c438197a8fdcc6d01d8" applicationName="Test Portal" implicitCreate="true"/>
    </ProvisioningTarget>
  </ProvisioningTargets>
</ProvisioningPlan>
4

The issue is that in Workflow Optimistic Provisioning was marked as false, due to which identity Event was getting created. However when i marked optimistic Provision as true the link is created.

<Variable editable="true" initializer="true" name="optimisticProvisioning">
    <Description>
      Set to true to enable optimistic provisioning.  This will cause
      changes to the entitlements compiled from role assignments to be
      applied immediately to the identity cube rather than waiting
      for the next refresh/reaggregation after the provisioning system
      completes the request.
    </Description>
  </Variable>

Thanks