Inquiry Regarding Workflow Error for Access Profile Retrieval

[joyoon00 (Jeongon Yoon)]

I am reaching out to discuss an issue we are currently facing with our workflow designed for the retrieval of access profiles.

As part of our system’s security and management protocols, we have implemented a workflow that automatically retrieves access profiles once a user’s status becomes either inactive or terminated. This process has been functioning effectively; however, we have encountered a significant challenge.

When the number of access profiles to be retrieved surpasses 200, the workflow results in an error, preventing us from retrieving the access profiles as intended. This limitation is impacting our ability to maintain our system’s security and efficiency.

Could you please provide any advice or solutions that could help us overcome this challenge? Any guidance on optimizing our workflow to handle larger volumes of access profiles without encountering errors would be greatly appreciated.

Thank you for your time and assistance. I look forward to your valuable insights.

[uday_kilambiCTS (Uday Kilambi)]

Hi @joyoon00 ,

Loop has a restriction of only 100 iterations. The operation you are intending to perform inside the loop is not very clear. Can you let us know what is the error that you faced?

If your intent is to revoke the access profiles assigned to the user, you can achieve this by recursive workflow. But, it has its limitations as well. Take a look on the below interesting post from Collin on Recursive workflows.

Recursive Workflows in IdentityNow

[header-image] IdentityNow Workflows provides a loop operator that allows a workflow to process many items in a list of data in a quick and efficient manner. While the loop operator is a built-in component of Workflows, there is another way to achieve looping functionality using features that are currently supported in the product. In this blog, I will demonstrate how to implement recursion in Workflows to achieve looping behavior without the need for the loop operator. What is recursion? …

Regards,
Uday Kilambi

[ondiaye (Ousmane N'DIAYE)]

@joyoon00

imitation is impacting our ability to maintain our system’s security and efficiency.

Hi @joyoon00,

I recommend to use GET Access for retriving access and Manage Access with “remove” actions rather than http request.

With that you can manage more access.

[colin_mckibben]

You might also find this blog post by @sharvari helpful. She demonstrates how to revoke all access for an identity in a workflow.

Emergency Terminations of Identities Using IdentityNow

[emergency-terminations] Emergency Terminations of Identities in Identity Now is one of the most common use cases we come across in Organizations these days In some cases, when an identity is terminated in an authoritative source, the identity’s accounts and access need to be disabled immediately. This use case can be handled in a few different ways. Automatic lifecycle state change Manual lifecycle state change Workflow Please continue reading to learn how to configure emergency termin…

[joyoon00 (Jeongon Yoon)]

Hi there,

I’ve been using the “GET Access” method to remove access profiles and entitlements successfully. However, I recently came across a discussion on the SailPoint developer forum where Julian Sosa recommended using HTTP methods for the removal process (you can find this discussion here). This advice was part of a broader conversation on managing entitlements with workflows, detailed in another forum post (see this post).

Given this advice, should I continue to use the “GET Access” method for removal, or is it now recommended to switch to HTTP methods for managing these tasks? I’m looking for the best practice in the current context, considering the suggestion from the forum.