Manager certifiation for account asn entitlements

IdentityIQ (IIQ) IIQ Discussion and Questions
,
1

Hi…

I have 2 scenarios while doing manager certifications.

  1. I have an application type of AD/JDBC/Delimited/JDBC configure with Webservice. I’m running Manager access reviews for all the types. I will create account-based review in the certification for which connected apps will go and disable the user if its disconnected application it will raise a manual work item. Now if I want to convert the same application into Entitlement based review. How do we achieve that?
  2. It’s regarding the delegation. If a manager is on leave, she will assign a delegate in the place of her. If the Manager comes back from leave the reviews starting from the day she will be back, should be assigned to her. And in the between if she comes back then once her leave period is over it should redirect to her. There should be some automation or any rule. Can we achieve that.

Please let me know if you have implemented the same in your environments.

2

Hi,

Can you elaborate more on what you mean when you say “Now if I want to convert the same application into Entitlement based review. How do we achieve that?”. Do you want to run an entitlement certification campaign for the same application?

On the delegation piece, I believe if the delegation is setup by the manager and they want to get the certification items back which were assigned to the delegate during the manager’s absence; the manager needs to manually explicitly undo the delegation.

If that is not working then some customization would have to be done to get these items re-assigned to the manager.

Regards,

3

Hi Nilesh,

Do you want to run an entitlement certification campaign for the same application?— yes.

4

@70daadca52466159b25a266a11e514f For Scenario 1:

  • Use Targeted Certification — This lets you certify at the entitlement level (Roles/Entitlements), with filters for specific applications.

  • Key Difference in Revocation Behavior:

    • Account-based review → revoke disables the entire account (connected) or raises a work item (disconnected)
    • Entitlement-based review → revoke removes the specific entitlement (e.g., AD group membership) for connected apps, or raises a work item for the specific entitlement removal on disconnected apps

  • You can also use Exclusion Rules to filter out birthright/default entitlements from the review.

For Scenario 2: Delegation Automation During Manager Leave:

  • ** Out-of-the-box, IIQ does not automatically return delegated items when the manager comes back.
  • Identity Trigger + Workflow (for already-delegated items)

Create an Identity Trigger that fires when the manager’s leave status changes from “On Leave” to “Active.” This launches a workflow that queries all open certifications where items are delegated and reassigns them back to the manager.

Hope this helps! Let me know if you need more details on any of these approaches.