# Identity Trigger for Owner Change **URL:** \ **Category:** IIQ Discussion and Questions\ **Tags:** identityiq, certifications, entitlements\ **Created:** [October 7, 2026, 6:27am UTC](https://developer.sailpoint.com/discuss/t/identity-trigger-for-owner-change/224920 "2026-10-07T06:27:03Z")\ **Posts on this page:** 18\ **Page:** 1
**Author:** ![prahantMishra](https://avatars.discourse-cdn.com/v4/letter/p/5fc32e/32.png) [@prahantMishra](https://developer.sailpoint.com/discuss/u/prahantMishra)\ **Post date:** [October 7, 2026, 6:27am UTC](https://developer.sailpoint.com/discuss/t/identity-trigger-for-owner-change/224920/1 "2026-10-07T06:27:03Z")
Hi All, Currently I’m building Identity Trigger to launch the certifications based on user owner change. In campaign I need the user account as well as entitlements and few applications I should exclude it from the campaign. Anyone has implemented such use-cases? If so, please can you provide your inputs. ---
**Author:** ![neel193](https://sea1.discourse-cdn.com/sailpoint/discuss/user_avatar/developer.sailpoint.com/neel193/32/34038_2.png) [@neel193](https://developer.sailpoint.com/discuss/u/neel193)\ **Post date:** [October 7, 2026, 6:55am UTC](https://developer.sailpoint.com/discuss/t/identity-trigger-for-owner-change/224920/2 "2026-10-07T06:55:08Z")
@prahantMishra Are you configuring a Certification Event or LifeCycle Event? ---
**Author:** ![prahantMishra](https://avatars.discourse-cdn.com/v4/letter/p/5fc32e/32.png) [@prahantMishra](https://developer.sailpoint.com/discuss/u/prahantMishra)\ **Post date:** [October 7, 2026, 7:06am UTC](https://developer.sailpoint.com/discuss/t/identity-trigger-for-owner-change/224920/3 "2026-10-07T07:06:25Z")
Hi @neel193 , Thanks for your response! It’s certification event. ---
**Author:** ![neel193](https://sea1.discourse-cdn.com/sailpoint/discuss/user_avatar/developer.sailpoint.com/neel193/32/34038_2.png) [@neel193](https://developer.sailpoint.com/discuss/u/neel193)\ **Post date:** [October 7, 2026, 9:30am UTC](https://developer.sailpoint.com/discuss/t/identity-trigger-for-owner-change/224920/4 "2026-10-07T09:30:45Z")
**Trigger configuration** — Set the Event Type to Attribute to fire on the attribute that represents “owner” (e.g. `manager` or a custom identity attribute). Use an **Exclusion Rule** on the certification. Write a rule of type `CertificationExclusion` and you can store the application names in the custom object to use it to figure out if you want to exclude the entitlements associate with these apps. ---
**Author:** ![prahantMishra](https://avatars.discourse-cdn.com/v4/letter/p/5fc32e/32.png) [@prahantMishra](https://developer.sailpoint.com/discuss/u/prahantMishra)\ **Post date:** [October 7, 2026, 10:50am UTC](https://developer.sailpoint.com/discuss/t/identity-trigger-for-owner-change/224920/5 "2026-10-07T10:50:29Z")
@neel193 , I want to create a campaign with entitlements and accounts together. I don’t think just with Certification Exclusion I should be able to do it. I believe I should touch base an OOTB java class as I need to include entitlements as well as and users account all together. Exclusion will work only to exclude some specific apps entitlements. ---
**Author:** ![neel193](https://sea1.discourse-cdn.com/sailpoint/discuss/user_avatar/developer.sailpoint.com/neel193/32/34038_2.png) [@neel193](https://developer.sailpoint.com/discuss/u/neel193)\ **Post date:** [October 7, 2026, 11:01am UTC](https://developer.sailpoint.com/discuss/t/identity-trigger-for-owner-change/224920/6 "2026-10-07T11:01:15Z")
@prahantMishra AFAIK OOTB you can’t put both entitlements and account together in the same certification or at least i haven’t used it. as the outcome of both these are different, one will remove and other delete/disable the account. ---
**Author:** ![neel193](https://sea1.discourse-cdn.com/sailpoint/discuss/user_avatar/developer.sailpoint.com/neel193/32/34038_2.png) [@neel193](https://developer.sailpoint.com/discuss/u/neel193)\ **Post date:** [October 7, 2026, 11:02am UTC](https://developer.sailpoint.com/discuss/t/identity-trigger-for-owner-change/224920/7 "2026-10-07T11:02:37Z")
@prahantMishra As it is not natively supported, I would not recommend touching the OOTBs java class to modify the certfification behaviour. Instead if you really want to achieve it, do it via Plugin and insert few custom xhtml pages with a customized view to have both entitlements and accounts review. ---
**Author:** ![prahantMishra](https://avatars.discourse-cdn.com/v4/letter/p/5fc32e/32.png) [@prahantMishra](https://developer.sailpoint.com/discuss/u/prahantMishra)\ **Post date:** [October 7, 2026, 11:05am UTC](https://developer.sailpoint.com/discuss/t/identity-trigger-for-owner-change/224920/8 "2026-10-07T11:05:03Z")
@neel193 yes exactly we can’t pull both together. I need to look for other way around. ---
**Author:** ![neel193](https://sea1.discourse-cdn.com/sailpoint/discuss/user_avatar/developer.sailpoint.com/neel193/32/34038_2.png) [@neel193](https://developer.sailpoint.com/discuss/u/neel193)\ **Post date:** [October 7, 2026, 11:06am UTC](https://developer.sailpoint.com/discuss/t/identity-trigger-for-owner-change/224920/9 "2026-10-07T11:06:33Z")
Go for plugins. that should be your best way to do the customization without modifying any standard modules. ---
**Author:** ![prahantMishra](https://avatars.discourse-cdn.com/v4/letter/p/5fc32e/32.png) [@prahantMishra](https://developer.sailpoint.com/discuss/u/prahantMishra)\ **Post date:** [October 7, 2026, 11:14am UTC](https://developer.sailpoint.com/discuss/t/identity-trigger-for-owner-change/224920/10 "2026-10-07T11:14:51Z")
Actually, plugins are not a suggested approach as per business so would need to go with java classes. Thanks for the suggestions @neel193 . ---
**Author:** ![prahantMishra](https://avatars.discourse-cdn.com/v4/letter/p/5fc32e/32.png) [@prahantMishra](https://developer.sailpoint.com/discuss/u/prahantMishra)\ **Post date:** [October 7, 2026, 11:30am UTC](https://developer.sailpoint.com/discuss/t/identity-trigger-for-owner-change/224920/11 "2026-10-07T11:30:54Z")
@neel193 , do you know which java class gets invoke if we trigger certification event? ---
**Author:** ![neel193](https://sea1.discourse-cdn.com/sailpoint/discuss/user_avatar/developer.sailpoint.com/neel193/32/34038_2.png) [@neel193](https://developer.sailpoint.com/discuss/u/neel193)\ **Post date:** [October 7, 2026, 12:20pm UTC](https://developer.sailpoint.com/discuss/t/identity-trigger-for-owner-change/224920/12 "2026-10-07T12:20:55Z")
@prahantMishra Primary handler is **`sailpoint.api.CertificationTriggerHandler`** and uses these builder class: **`sailpoint.api.CertificationBuilderFactory` & `sailpoint.api.Certificationer`**. **`CertifiableAnalyzer`** used to generate Certifiables (Roles & Entitlements) and it excludes both ent and accounts together. There could be additional classes but these are the ones i am aware of. Also, as it is coming via identity triggers, so `sailpoint.api.Identitizer` should also be in use. ---
**Author:** ![punna0001](https://sea1.discourse-cdn.com/sailpoint/discuss/user_avatar/developer.sailpoint.com/punna0001/32/42011_2.png) [@punna0001](https://developer.sailpoint.com/discuss/u/punna0001)\ **Post date:** [October 8, 2026, 2:00am UTC](https://developer.sailpoint.com/discuss/t/identity-trigger-for-owner-change/224920/13 "2026-10-08T02:00:28Z")
Hello Prashant. Since plugins are not an option for your business, I would suggest trying one OOTB option before modifying the Java classes. If you require the reviewer to review individual entitlements and also allow the reviewer to revoke the whole account, try setting **Included Access = Entitlements** and enabling **Enable Account Revocation** under the **Certification Event Behavior** settings. This gives the reviewer entitlement-level decisions and a Revoke Account option. Choosing Revoke Account initiates revocation of the account and its associated entitlements. The actual removal follows the configured certification revocation process. You can also use Included Applications to select only the applications you want certified, so a separate Exclusion Rule may not be needed. For the owner-change trigger, use Manager Transfer if owner means the manager, or Attribute Change if it is a separate identity attribute. Also make sure Process Events is enabled in Identity Refresh. The limitation is that this does not give you the account and each entitlement as independent review items in the same certification. If separate reviews are acceptable, one option worth testing is two Certification Events for the same owner-change condition, one for Accounts and one for Entitlements, though those would be separate reviews rather than one combined certification. Regarding Java, Neel has already identified `CertificationTriggerHandler` and the related classes. I would use them for tracing rather than modifying the internal implementation. If independent account and entitlement decisions in one certification are mandatory, I would validate the supported options with SailPoint Support before changing the core certification logic. I would first test Enable Account Revocation and see if it meets your business requirement. ---
**Author:** ![prahantMishra](https://avatars.discourse-cdn.com/v4/letter/p/5fc32e/32.png) [@prahantMishra](https://developer.sailpoint.com/discuss/u/prahantMishra)\ **Post date:** [October 8, 2026, 5:41am UTC](https://developer.sailpoint.com/discuss/t/identity-trigger-for-owner-change/224920/14 "2026-10-08T05:41:44Z")
Hi Harish, Thanks for your suggestion! But, ask to embed entitlements and accounts together in a single certification campaign rather than splitting it into two for accounts and entitlements separately. I checked the `CertificationTriggerHandler `event and it’s associated classes, eventually event end up calling certification builder class to build certifications. Probably, I will have to look into it. If needed I will open a case with SailPoint Support too. ---
**Author:** ![punna0001](https://sea1.discourse-cdn.com/sailpoint/discuss/user_avatar/developer.sailpoint.com/punna0001/32/42011_2.png) [@punna0001](https://developer.sailpoint.com/discuss/u/punna0001)\ **Post date:** [October 8, 2026, 6:32am UTC](https://developer.sailpoint.com/discuss/t/identity-trigger-for-owner-change/224920/15 "2026-10-08T06:32:04Z")
Hello Prashant. Thanks for clarifying. I understand that you need both accounts and entitlements together in a single certification. Since you have already traced the flow to the certification builder, I would be careful about modifying those internal classes. Changes there could affect certification decisions, revocation processing, and future upgrades. I think opening a SailPoint Support case would be a good next step. I would specifically ask whether your IIQ version has a supported extension point to include both account and entitlement review items in one certification. Also, whether the account also needs its own independent Approve or Revoke decision, or whether displaying it alongside its entitlements is sufficient. That could make a difference in the approach. I have not found a documented, supported customization for this requirement, so I would confirm with Support before changing the OOTB classes. ---
**Author:** ![prahantMishra](https://avatars.discourse-cdn.com/v4/letter/p/5fc32e/32.png) [@prahantMishra](https://developer.sailpoint.com/discuss/u/prahantMishra)\ **Post date:** [October 8, 2026, 6:54am UTC](https://developer.sailpoint.com/discuss/t/identity-trigger-for-owner-change/224920/16 "2026-10-08T06:54:12Z")
Hi Harish, Version is 8.5p2 Yes, need accounts and entitlements both with approve and revoke functionality. If it would be just displaying the details, I would have achieved it by using customization rules. But in current use-case I need both of them to be in certifiable items for certifier review and take action on it. ---
**Author:** ![punna0001](https://sea1.discourse-cdn.com/sailpoint/discuss/user_avatar/developer.sailpoint.com/punna0001/32/42011_2.png) [@punna0001](https://developer.sailpoint.com/discuss/u/punna0001)\ **Post date:** [October 8, 2026, 8:14am UTC](https://developer.sailpoint.com/discuss/t/identity-trigger-for-owner-change/224920/17 "2026-10-08T08:14:01Z")
For 8.5p2, I could not find a documented OOTB option or a supported extension point to treat the account and its entitlements as separate certifiable items, each with its own Approve or Revoke decisions, within a single certification. Since modifying the certification builder carries upgrade risk and has to keep revocation handling correct, I would confirm with SailPoint Support whether 8.5p2 has a supported extension point for this before changing those classes. ---
**Author:** ![prahantMishra](https://avatars.discourse-cdn.com/v4/letter/p/5fc32e/32.png) [@prahantMishra](https://developer.sailpoint.com/discuss/u/prahantMishra)\ **Post date:** [October 9, 2026, 8:20am UTC](https://developer.sailpoint.com/discuss/t/identity-trigger-for-owner-change/224920/18 "2026-10-09T08:20:20Z")
Hi Harish, Thanks for checking doc! I have resolved the issue. Now in certification I could see user entitlements and accounts with all customizations in place by leveraging customization rules in a such a way that it should show the required certifible items.