I have a requirement in IdentityIQ where both the User Management team and Audit team need access to the same identities/user data, but I need to restrict visibility of a specific identity attribute.
For example:
Identity has an attribute called Location
User Management team → should be able to view Location
Audit team → should be able to view the identity, but should not see the Location attribute
I understand that IdentityIQ provides a Visibility Selector for identity attributes and extended attributes. It supports options such as Match List, Filter, Script, Rule, and Population.
My questions are:
Can Visibility Selector be used to achieve this requirement based on the team/workgroup/capability of the logged-in user?
If yes, what would be the recommended approach — Rule, Filter, or Population?
Can we similarly restrict visibility of a specific entitlement from the Audit team while allowing the User Management team to see it?
If Visibility Selector is not applicable to entitlements, should we use Capabilities and Scopes instead?
Any practical examples or recommendations would be appreciated.
Yes. For the Location identity attribute, I would suggest using the Visibility Selector. It is evaluated against the user viewing the identity, so the selector should identify the User Management users who are allowed to see that attribute.
For this requirement, a Population can work well if it is based on the User Management workgroup. A Rule would give you more flexibility if you need additional logic, such as checking capabilities or multiple conditions.
For entitlements, the identity attribute Visibility Selector does not apply. Capabilities control access to IIQ features, while Scopes control access to scoped objects. However, I would not rely on Scopes to hide one specific entitlement from the Audit team in every view.
If the requirement is specifically to hide an individual entitlement from the Identity Entitlements view while still allowing the Audit team to see the identity, this may require UI/plugin customization.
I only need location attribute needed to be hide for audit team and it should be visible for user management team.Thats all…so for this visibility selector is enough right!?
Yes, for that exact requirement, the Visibility Selector is enough, provided Location is an identity or extended identity attribute.
I would suggest creating or selecting a Population based on the User Management workgroup and using that Population in the Visibility Selector for Location. User Management users will be able to see the attribute, while Audit users will still be able to view the identity but will not see Location (SailPoint Documentation — Identity Mappings; Creating Populations).
The Visibility Selector does not apply to standard or system identity attributes (SailPoint Documentation).
@0b99ab09df906dbb308c1918342794f Which view are they using to access identity data? Advance Analytics or identity warehouse or any custom form based view?
@0b99ab09df906dbb308c1918342794f depending on the complexity we can write rule or population or match list. Also i believe this option will be apply on view identity page not other page(may be need to recheck)
I do not think entitlement catalog as of now having this feature