Hi @SanjeevCog, welcome to the SailPoint Developer Community!
As the replies above confirm, ISC roles cannot contain other roles, so moving a nested model to ISC means flattening the hierarchy. I would do it in this order:
- Resolve each legacy parent role to its effective access. List every entitlement it grants, including what it gets through its child roles, and group the list by source.
- Turn each child role into access profiles, one per source it touches, because an access profile holds entitlements from a single source (Managing Access Profiles). Keep access in access profiles rather than adding entitlements directly to roles. When a child’s access changes later, you edit one access profile and every role that uses it follows.
- Decide whether each child still needs to be a role. If it is only ever granted through its parent, the access profiles are enough. If it is also assigned or requested on its own, create a role for it that holds the same access profiles.
- Rebuild each parent as a role that holds its children’s access profiles plus any access of its own, and move the legacy assignment logic into role criteria. Criteria can check identity attributes, account attributes, or entitlements on a source (Automating Role Assignment). The criteria schema in the Roles API nests only three levels deep, so very complex legacy logic may need simplifying.
- Look for children that exist only because one job needs different access by department or location. A single dynamic role with dimensions can replace them. Dimensions use identity attributes that you enable for them (Managing Roles).
If one role must be assigned only to holders of another, its criteria have to check an entitlement the first role provisions. That entitlement only counts after an aggregation reads it back into ISC, so the second role arrives later than the first.
When an identity stops matching a role’s criteria, ISC removes the role and its access but leaves the source accounts in place (Automating Role Assignment).
For a worked example of dimensions, see Reduce Role Sprawl with Dynamic Access Roles in ISC. For when to use an access profile versus a role, see Should I use access profiles or roles?.
If you share one parent role with its child roles (names and what each grants), we can map it through these steps.