# Identity & Role reports **URL:** \ **Category:** IIQ Discussion and Questions\ **Tags:** identityiq\ **Created:** [October 5, 2023, 9:44pm UTC](https://developer.sailpoint.com/discuss/t/identity-role-reports/18659 "2023-10-05T21:44:04Z")\ **Posts on this page:** 10\ **Page:** 1
**Author:** ![venus](https://avatars.discourse-cdn.com/v4/letter/v/35a633/32.png) [@venus](https://developer.sailpoint.com/discuss/u/venus)\ **Post date:** [October 5, 2023, 9:44pm UTC](https://developer.sailpoint.com/discuss/t/identity-role-reports/18659/1 "2023-10-05T21:44:04Z")
Hi All, I am planning to extract following data from Identity IQ via either reports or SQLs(as last option). Could you please let me know what best options I have to exact the data? Identity name, list of entitlements have outside of the roles (not 100% sure, those are called exceptions). If I could get this data either in a Single report or multiple reports and use excel for further conversion is also fine. If I could not get this using a single report. I am planning to get the list of entitlements an Identity have into ONE report, 2nd report to pull the business roles and all the associated entitlements(via IT roles) and then get the difference. I feel, 2nd report seems to be complicated as there are lot of levels as there multiple tables are involved to get the roles report. I have used the API at my previous organization but unfortunately that is not an option my current organization wanted to follow. Please let me know if there are any easier ways to pull this info. Please let me know if you need any more information. Thanks, ---
**Author:** ![dheerajk27](https://sea1.discourse-cdn.com/sailpoint/discuss/user_avatar/developer.sailpoint.com/dheerajk27/32/3514_2.png) [@dheerajk27](https://developer.sailpoint.com/discuss/u/dheerajk27)\ **Post date:** [October 6, 2023, 2:31am UTC](https://developer.sailpoint.com/discuss/t/identity-role-reports/18659/2 "2023-10-06T02:31:23Z")
> [@venus](#): > > I have used the API at my previous organization but unfortunately that is not an option my current organization wanted to follow. Please let me know if there are any easier ways to pull this info. HI @venus , You can create a custom report by using QueryOption and Filter object and collect the data you need in String List and then use Email Attachment and EmailOptions to sent the collected report over email as attachment. ---
**Author:** ![aishwaryagoswami](https://sea1.discourse-cdn.com/sailpoint/discuss/user_avatar/developer.sailpoint.com/aishwaryagoswami/32/4357_2.png) [@aishwaryagoswami](https://developer.sailpoint.com/discuss/u/aishwaryagoswami)\ **Post date:** [October 6, 2023, 10:08am UTC](https://developer.sailpoint.com/discuss/t/identity-role-reports/18659/3 "2023-10-06T10:08:39Z")
Hey @venus , If I’m not wrong then wont a report with just the identity and its entitlement in a particular application fulfil your requirement instead of getting two reports and then comparing it. I would say you also think about a rule runner task which can look into getting entitlements of the identities in the particular application (which you are looking for) put that in a csv and send that in csv over an email. ---
**Author:** ![Jarin\_James](https://sea1.discourse-cdn.com/sailpoint/discuss/user_avatar/developer.sailpoint.com/jarin_james/32/3372_2.png) [@Jarin\_James](https://developer.sailpoint.com/discuss/u/Jarin_James)\ **Post date:** [October 6, 2023, 4:58pm UTC](https://developer.sailpoint.com/discuss/t/identity-role-reports/18659/4 "2023-10-06T16:58:35Z")
Hi @venus The best approach will be to use Identity IQ Reports. The Datasource object can be IdentityEntitlements and filter with grantedByRole equals to false to get the users and their entitlements which are not assigned by Role. Refer this solution which will help to filter on IdentityEntitlements. : [Active employees of a department with their applications and related entitlements - IdentityIQ (IIQ) / Discussion and Questions - SailPoint Developer Community Forum](https://developer.sailpoint.com/discuss/t/active-employees-of-a-department-with-their-applications-and-related-entitlements/14895/13) ---
**Author:** ![venus](https://avatars.discourse-cdn.com/v4/letter/v/35a633/32.png) [@venus](https://developer.sailpoint.com/discuss/u/venus)\ **Post date:** [October 11, 2023, 5:15pm UTC](https://developer.sailpoint.com/discuss/t/identity-role-reports/18659/5 "2023-10-11T17:15:40Z")
Hi @Jarin_James, Thanks you for your suggestion, I tried custom report with the link you have shared. I noticed strange issue with my DB. I ran the below query just to validate my report, but does not return any results. Is there anything wrong with our environment? SELECT \* FROM spt\_identity\_entitlement where granted\_by\_role=1; There is no impact even though to report though I use the filter by grantedByRole. ---
**Author:** ![Jarin\_James](https://sea1.discourse-cdn.com/sailpoint/discuss/user_avatar/developer.sailpoint.com/jarin_james/32/3372_2.png) [@Jarin\_James](https://developer.sailpoint.com/discuss/u/Jarin_James)\ **Post date:** [October 11, 2023, 5:46pm UTC](https://developer.sailpoint.com/discuss/t/identity-role-reports/18659/6 "2023-10-11T17:46:23Z")
Hi @venus, That is strange. It should be having values if you have entitlements assigned via role. And how is the report returning results if you are having the same criteria? 🤔 ---
**Author:** ![Remold](https://sea1.discourse-cdn.com/sailpoint/discuss/user_avatar/developer.sailpoint.com/remold/32/3275_2.png) [@Remold](https://developer.sailpoint.com/discuss/u/Remold)\ **Post date:** [October 11, 2023, 6:01pm UTC](https://developer.sailpoint.com/discuss/t/identity-role-reports/18659/7 "2023-10-11T18:01:33Z")
There is also an option to start a certification (manager or application) with the following options: ![image](https://global.discourse-cdn.com/sailpoint/original/2X/2/26c58f1cf81cf488cef867eb6f1b5be6b846e326.png) Using a certification (Access Review) you keep the data within IdentityIQ and have it assigned to a person to review. It also provides a way to make decisions on which additional entitlements are allowed or should be removed. – Remold ---
**Author:** ![venus](https://avatars.discourse-cdn.com/v4/letter/v/35a633/32.png) [@venus](https://developer.sailpoint.com/discuss/u/venus)\ **Post date:** [October 12, 2023, 2:45pm UTC](https://developer.sailpoint.com/discuss/t/identity-role-reports/18659/8 "2023-10-12T14:45:49Z")
GM All, I wanted to get the list of IT roles and their associated entitlements. Can I use RoleEntitlement as a datasource and build a custom report to pull this info? Basically, I wanted below fields. RoleName, Entitlement(Value and Name), ApplicationName. Thanks in advance, ---
**Author:** ![Remold](https://sea1.discourse-cdn.com/sailpoint/discuss/user_avatar/developer.sailpoint.com/remold/32/3275_2.png) [@Remold](https://developer.sailpoint.com/discuss/u/Remold)\ **Post date:** [October 13, 2023, 12:37pm UTC](https://developer.sailpoint.com/discuss/t/identity-role-reports/18659/9 "2023-10-13T12:37:55Z")
Hi Venugopala, Have you looked at the OutOfTheBox report ‘Role Profiles Composition Report’ ? If you want to split the entitlements into app - property - value, I would suggest to create a Java Source report, which gives full control on what you want and how it will look etc. – Remold ---
**Author:** ![system](https://global.discourse-cdn.com/sailpoint/original/2X/f/f2136700ed5e3703e0b85e02f6be799dacca7735.png) [@system](https://developer.sailpoint.com/discuss/u/system)\ **Post date:** [December 12, 2023, 12:38pm UTC](https://developer.sailpoint.com/discuss/t/identity-role-reports/18659/10 "2023-12-12T12:38:28Z")
This topic was automatically closed 60 days after the last reply. New replies are no longer allowed.