IIQ version: 8.3 I hope i have a simple question :smiley: Currently I do some testings on whats happen, if an entitlement is no longer available. The jdbc connector builds with a GroupAggregation-Task the entitlement catalog - okay. And if the group is no longer available, the entitlements gets d…

Thanks to [image] @vishal_kejriwal1 Vishal Kejriwal linkedin.com/in/vishalkejriwal 15 years of experience in Identity Governance , I am an expert in designing implementing secure identity governance so…

Hi chris kk , Here is the hyperlink to the SailPoint IdentityIQ documentation to manage uncorrelated accounts: Manage Uncorrelated Accounts - SailPoint IdentityIQ Documentation Please refer to this document for comprehensive guidance on effectively managing uncorrelated accounts within the SailPoi…

Hi @chriskk , If you are referring to updating the role model as well, you will have to run Propagate Role Changes task. You can refer the Propagating Role Changes section in this document. 8.3 IdentityIQ Role Group and Population Management Guide - Compass (sailpoint.com)

Hi @Chriskk & @Jarin_James , Propagate role changes task will help in removing the roles from the identity cube if the role/entitlement has been deleted from the role. But in this scenario explained by @chriskk , the role composition is not modified. The entitlement that was present in the role has …

Thanks you for your clarification. In my opinion, IIQ should help to automate this behavior :wink: If I really need to watch these changes manually: How can IIQ help me to collect this information (e.g. a list of deleted entitlements) and send this to some people so they can react? Currently is …

Yes, Role object is static one, whereas the Identity object is dynamic where it gets updated/modified by different task. If the role object is also dynamic, it would eliminate a lot of stale data.

We have the exact same problem. I consider this a bug of IIQ (v8.3). Support said this is an “idea” for improvement. So I wrote a bug report as an idea: https://ideas.sailpoint.com/ideas/IIQ-I-1169 Please vote and comment on this. I try to rephrase the bug/problem as clear as possible: busin…

JDBCConnector delete/cleanup orphan entitlements (role- and identity-assignments)

IdentityIQ (IIQ) IIQ Discussion and Questions

frerkmeyer (Frerk Meyer) March 1, 2024, 2:01pm 9

Thanks to

I was able to write a cleanup task:

Topic		Replies	Views
Entitlement and Roles IIQ Discussion and Questions identityiq , roles , entitlements	2	185	September 21, 2024
Entitlement does not remove from IdentityCube and Role after entitlement deleted IIQ Discussion and Questions identityiq , entitlements	5	172	January 25, 2025
IT role and entitlements stay back after the Business role is removed as per the criteria IIQ Discussion and Questions apis , rules , identityiq , provisioning , connectors , entitlements	14	160	March 21, 2026
IT role entitlement is showing incorrect AD group information IIQ Discussion and Questions aggregation , identityiq , roles , entitlements	20	575	May 17, 2024
Roles automatically cleanup removed Entitlements IIQ Discussion and Questions workflows , identityiq , provisioning , roles	1	73	February 25, 2025

JDBCConnector delete/cleanup orphan entitlements (role- and identity-assignments)

Related topics