Introduction of a new flow between Certifier and SNC ticket creation

IdentityIQ (IIQ) IIQ Discussion and Questions
1

I have a requirement to introduce a new flow to assign the WorkItem to another group while the Certifier of the WorkItem is revoking it.

Could someone please advise, if it is feasible to implement, If yes, pls advise how ?

2

With the minimal information you provide for your new flow I think it might be a good idea to understand the Certification Phases. As it looks like the answer (ak you new flow) is already part of the Revocation phase.

See Phases of a Certification

So after a an access review (by manager, app owner, …) [Active Phase], there can be a Challenge Phase where the users can challenge the decisions made. THe Revocation Phase can be used to send out work-items to different identities/workgroups.

There are rule-types available to set specific assignments of created work items (for example WorkItemEscalationRule.

It might be a good idea to elaborate a bit more on what your requirement is, so we can provide a better/more specific answer/advice.

– Remold

3

Hi Remold, Thanks for your quick response.
Here is my requirement: As per the existing flow, when the certifier revokes any workItem it goes to servicenow and creates a ticket for revocation of Access, however as per the current requirement it should go to another level of approval assigning to a particular workgroup, and based on their decision it will go to either ServiceNow or an email notification will be sent to the certifier mentioning why cannot be revoked.

4

Hi Remold, Any advise on my question?

5

There are 2 things in your question:

  1. another level of approval assigning to a particular workgroup
  2. decision it will go to either ServiceNow or an email notification will be sent to the certifier

Here are my thoughts on both points:

  1. This can be done in the ‘challenge phase’ of the certification. Where you can use a ‘CertificationPhaseChange’-rule to change the assignment of the revocations to a particular workgroup (See Rules in IdentityIQ for the ‘CertificationPhaseChange’-rule)

  2. a) Lots of Email Notifications can be set for the challenge phase, see:

    image
    image906×263 17.1 KB

    b) ServiceNow tickets are basically created based upon a (de-)provisioning. There is a way to create a custom ServiceNow connector where ticket can be created ad-hoc when needed (we have one created for multiple customers which I am not allowed to share).
    More information on the ServiceNow integration can be found on the SailPoint documentation site.

So yes, it is possible to meet your requirements, but it is quite advanced to set it up. My advice is to contact a SailPoint Global System Integrator Partner or Professional Services to set this up.

– Remold

1 Like
6

Thanks Remold for the valuable information.

7

This topic was automatically closed 60 days after the last reply. New replies are no longer allowed.