We are experiencing an issue with ISC where manual account uncorrelation does not persist after aggregation.
When we manually uncorrelate an account, it initially works as expected. However, after the next account aggregation, the account is automatically re‑correlated to an identity. We have to uncorrelate the same account a second time to make it stick.
Support suggested changing the correlation logic or account attributes as a workaround which is not acceptable for us.
We believe this is a bug or functional gap.
Has anyone else encountered this behavior? Any confirmation, explanation, or best practice would be appreciated.
Manual uncorrelation is overridden during aggregation if the correlation criteria still match. To prevent re-correlation, update the correlation logic or add exclusion flag to skip such accounts.
Hmmm, interesting conversation. Manual uncorrelation is provided so one can fix the problem with the source account without doing a full unoptimised aggregation. If your correlation rule is still applicable, of course it will re-correlate.
@j_place when you say “re-correlate” are you saying the account will be linked to the identity as per correlation rule if the account was already correlated manually to a different identity? The document disagrees.
Removing Manual Correlation
When an account has been manually correlated to an identity, it will not be recorrelated to another identity even if the account attributes change. You must manually remove the account from the identity to correlate it to a different identity.
The account can then be updated on the source so that during the next aggregation, the account is assigned to a new identity.
You can remove a manually-correlated account from an identity in several ways:
Remove the account you need to uncorrelate from Identity Security Cloud.
Go to Accounts and select Actions > Remove Account beside the account you want to remove.
Manually move the account to the new identity by updating the correlation file and re-uploading it to the source.
Reset all aggregated source accounts and entitlements. This option removes all of this source’s accounts and entitlements from Identity Security Cloud. When you aggregate again, the source accounts and entitlements are loaded and the correlation logic is recalculated.
@fatimahm I think you have a case to make with support unless you are removing the accounts before next aggregation.
To solve the auto-recorrelation of accounts to a cube that were manual uncorrelated, we ended up using a test identity as a dumping ground for sub-accounts.
We used to manually correlate to that cube, then raise a ticket to the relevant team to have the sub-account deleted.
If the logic exists to correlate the account to a cube, ISC will always do that unless the ‘manually correlated’ flag is set to ‘true’ - which only happens when it gets attached to a different cube.