Before moving to ISC from IIQ, we had a Role that used an Identity Selector Rule to populate the Role.
Criteria is - Identity does not live in Canada, but is manager of a Canadian Identity
Would this now fall into needing to submit a Cloud Rule request, or perhaps someone here has some brilliant idea on a method to get this to work?
Appreciate any ideas, thanks.
Your options related to Role assignment is quite limited in ISC compared to IIQ. There are no options to directly attach a rule for Role assignment. Instead you will have to create a new Identity Attribute (say Manager of Canadian Identities) that defines if the user is manager of any Canadian Identity and will have a value true or false. Then you can use this identity attribute under Role Membership criteria.
You will probably need a Cloud rule to calculate the above Identity Attribute, unless you can find some logic to calculate the attribute value using a transform.
Hi @chrisk
What @iamnithesh mentioned is your easiest and most OOTB option. You’ll like need a cloud transform rule to calculate the boolean for Manager of a Canadian identity.
Another option is an external script which could be triggered through PAG/PTA in Workflows. You could scan all the identities, perform that logic check, then using the “Identity List” role assignments to make the changes to the role membership from there (Adding/Removing Users) using API calls.
Overall, I like Nitesh’s approach more, but I’m biased towards never using cloud rules if I don’t absolutely have to, so I would use the second option 
Hope this helps and let me know if you have any questions on the approach.
The question was for ISC not IIQ. Manage Attributes action and Populations do not exist in ISC.
There is a limit on the number of identities you can add to a Role using this method, and I think the number is 500
Good point, I doubt his case has 500 users with that criteria since it seems like an edge case, but good to know the limits before going down this path.
Still agree with you on the identity attributes path being the easiest & most OOTB.
OK, thanks for the great answers. I guess it looks like Identity Attribute/Cloud Rule is the route to take - would have preferred otherwise.
Thanks again!