We have annual manager cert on access items we have around 60 k entitlement some 5 k role
When we try to generate cert from search we are hitting search limit of 10 k items
As work around created an exclusion filter with API problem is whenever new entitlement or role is added to this list the filter needs to be updated that is a manual thing
Another approach would slicing down by region or so to cut Down API limit but we don’t want the same identity have multiple annual certifications
Has anyone of you come across such issues at ISC access item certification if yes how you have handled it
Any leads will help
Edit : why we are including all the access items into annual manager cert because we are coming from IIQ back ground
I recently encountered the same limitation where several sources exceeded 10,000 entitlements. As a workaround, I opted to split the campaigns into multiple as a workaround. FYI, I did that using a PS Script.
Hi @ajmerasunny , As I already mentioned we don’t want the same identity to present to multiple annual certifications we have not choose to proceed further
This looks like a common ISC limitation when Access Item Certifications hit the search/API limit. A practical workaround is to split the certification into multiple campaigns based on criteria like region, department, or business unit, while ensuring the same identity is included in only one campaign to avoid duplicate reviews. This is much easier to manage than maintaining manual exclusion filters. If required, the split can also be automated using API/script so it remains manageable as entitlement volume grows.
Access model metadata, which is a relatively new feature, also helps with scoping the certifications down. You can add custom attributes like Application, isWhitelist, or whatever approach you’d like to split certifications up into more specific certifications. Here’s some documentation on it: