Scenario:
We have a Business Role with an assignment rule based on identity attributes (location). When the condition no longer matches (e.g., user moves to London), the Business Role is correctly removed. However, the IT Role linked to the Business Role is still showing as Detected on the identity, and the entitlements are still present on the Azure AD account.
What we have already checked and confirmed:
Allow propagation of role changes Enabled in Global Settings
Retain assigned entitlements when detected roles are removed Unchecked
Retain assigned entitlements when assigned roles are removed Unchecked
Disable deprovisioning of deassigned roles Unchecked in Identity Refresh task
Refresh assigned, detected roles and promote additional entitlements Checked
Provision assignments Checked
Ran Propagate Role Changes task
Ran Identity Refresh task
No provisioning transaction found for the removal
No ProvisionAssignment found in identity XML
IT Role is not part of any other Business Role
Entitlement was provisioned by IIQ through assignment rule, not added natively outside IIQ
Observation from Identity XML:
roleAssignments tag: Business Role removed correctly
roleDetection tag: IT Role still present but NO assignmentId
Is there any configuration or task to auto-remove soft permitted IT roles when the Business Role is removed via assignment rule?
@malarPermitted IT roles are independent, optional assignments. When a Business Role is removed, any associated Permitted IT roles are not automatically removed and will remain on the user’s identity. If you need them to be revoked automatically, you should change IT role to Required role.
From your explanation, it looks like when the condition matches, the Business Role gets assigned correctly, and when the condition no longer matches, the Business Role is removed. However, the IT Role and entitlements are still present.
Here, the Detected status usually means that the user already has those entitlements on the target source/account, and the same entitlements are configured within the IT Role. Because of this, IIQ detects the role based on the existing entitlements on the account.
I would suggest checking the Rapid Setup Leaver configuration as well. It can help remove entitlements when the user account is deprovisioned or disabled.
Please verify if this behavior matches your scenario.
@malar Could you please check your impacted identity → Entitlement and see if Allowed By is showing the associated business role name? If not, means role was not detected via business roles. In that case there could be some issues with your role assignments.
Check whether the same entitlements are also part of any other business or IT role assigned to the user, as this may result in those entitlements being retained and excluded from removal.
would you be able to please retry the operation and enable tracing
on the following class
sailpoint.provisioning.PlanEvaluator
(DevSAK will do that by issuing the following command: setLogLevel sailpoint.provisioning.PlanEvaluator trace)
Please share the ProvisioningPlan with us.
For sure you can check for any operations related to the attributes in scope.
Apart from that: How does the IdentityEntitlement look on the Identity?
As mentioned above check if the entitlement is part of multiple IT roles. We have encountered similar issue. We had to manually remove the entitlement and it role.
Hi, I’m experiencing the same issue as OP as well. In my scenario, I’m assigning a business role to users via an assignment rule, which also clears clears the negativeAssignment flag.
// Helper method to remove role assignments with optional negative-only filtering
void removeRoleAssignment(String identityName, String roleName, boolean negativeOnly) {
if (roleName == null) {
return;
}
List<RoleAssignment> roleAssignments = identity.getRoleAssignments(roleName);
if (roleAssignments == null || roleAssignments.isEmpty()) {
return;
}
if (negativeOnly) {
for (RoleAssignment assignment : roleAssignments) {
if (assignment.isNegative()) {
assignment.setNegative(false);
}
}
} else {
for (int i = roleAssignments.size() - 1; i >= 0; i--) {
roleAssignments.remove(i);
}
}
context.saveObject(identity);
context.commitTransaction();
}
My issue is that when the business role is unassigned via the rule, the system does not deprovision the entitlement configured in the required IT role.
@Deon on a side note.. you can move your negative=true code to pre-refresh rule and only keep the assignment related logic in roles and if possible, make it attribute based.
Hi Neel, It is not happening for all users, only on just a few. I cannot reproduce this issue, but I suspect is a data race issue for the IdentitySelector assignment rule evaluation.
@Deon Yeah.. you can move negative flag removal code to prerefresh and keep the assignment logic stick to criteria.. Give it a try and see if it works for you or not.
with the similar issue,
where the business role has been removed from the user account but the IT role is still detect on the account. and still exist on the account.
once the business role is assigned and removed.
IT role is not removing.
additional,
wanted to know to is the role/entitlement is directly assigned on the user account from the end application.
and later it is detected in sailpoint and IT roles marked as deteched.
but business role is not assigned but to filter or rule not match, then can we remove the IT role. (meaning the assigned role/entitlement) from the end application.
Enabled in Global Settings
