Is it possible to assign a workgroup as a Policy Rule Owner in an SOD Policy?

IdentityIQ (IIQ) IIQ Discussion and Questions
1

Which IIQ version are you inquiring about?

8.4p2

Please share any images or screenshots, if relevant.

image
image802×471 12.1 KB

Share all details about your problem, including any error messages you may have received.

Hi all,

I’m working with IdentityIQ 8.4 and have run into an issue while configuring Separation of Duties (SoD) policies.

I understand that at the policy level you can assign a Policy Owner and a Policy Violation Owner, and these can be either an identity or a workgroup (as documented in the IIQ 8.4 Policy Management guide). However, when I try to assign a workgroup as the Policy Violation Owner for an individual SOD rule, the value does not persist — it saves as “None”.

From what I can tell, rule‑level Policy Violation Owners appear to support only identities, the manager of the violating user, or a rule that selects an identity. But I want to confirm whether that limitation is intentional and documented, or if there is a supported method to assign a workgroup specifically at the rule level.

My questions:

  1. Is it technically possible in IdentityIQ 8.4 to assign a workgroup as the Policy Violation Owner for a specific SOD policy rule?

  2. If not, are there recommended approaches or best practices for handling rule‑level ownership by groups, such as functional identities or owner‑selection rules?

Any guidance, documentation references, or examples would be greatly appreciated.

Thanks!

2

Have you tried updating that in debug and saving it manually?

Not suggesting as a solution but to see if maybe it’s a GUI thing.

It should be possible imho.

3

Hi @acgsneddon That is not a limitation, as you showed in the screenshot, you didn’t select the Identity radio button. It selected the None radio button, which is why it’s storing None on the policy violation owner. Select the Identity radio button, and it will save the workgroups.

image

Thanks,

PVR.

4

@acgsneddon Which policy are you testing? I just tried it in Role SOD and am able to set the workgroup as owner.

5

Hi all, thank you for your responses. I tested your suggestions in our lower environment and was able to successfully update the rule owner through the UI. However, when I tried the same steps in our Production environment, any attempt to assign a workgroup as the rule owner reverts back to “None” after saving and reopening the policy rule.

This makes me think the issue may be linked to a configuration difference between environments, although I haven’t yet identified what that might be. My next step is to test whether the update persists if I make the change directly through Debug.

Thanks again for your help so far.