We are currently working on the NetSuite SaaS connector. The NetSuite team has a requirement whereby, before a user can submit or proceed with an access request, the GetAccess attribute must first be set to “True” and send email value must also be updated to “True”. Only after these conditions are met can the access request be initiated.
This is the process currently followed by the NetSuite team. Could you please advise how this workflow or validation can be implemented in SailPoint?
As far as I know, SailPoint ISC doesn’t have a built-in way to block someone from submitting an access request based on an attribute value. There are a few ways to get the same result, though:
Set the values during provisioning. In NetSuite, “Give Access” and “Send Email” are part of the employee record. If they just need to be true for the access to work, set them in the connector’s create/update operation or with a Before Provisioning rule, so the requester never has to touch them.
Validate with a Workflow. Use the Access Request Submitted (or Dynamic Approval) trigger, check getAccess and sendEmail, and deny or reroute the request if either isn’t true. This runs after submission, so it can reject the request but not stop it from being submitted.
Add an approval step. If someone has to set the values manually, make the NetSuite team an approver so they fix the attributes first, then approve.
Looks like the approaches suggested by @suraj_gorle is good. One additional point to consider is whether giveAccess and sendEmail are truly prerequisites for every NetSuite access request, or whether they are simply part of the NetSuite account onboarding process. The Oracle NetSuite connector supports both attributes as provisioning attributes, with giveAccess specifically supported for update operations. If these settings are required for all NetSuite users, I would be inclined to manage them automatically during account creation/update rather than validating them on every request. This keeps the access request process simpler and avoids users seeing avoidable request rejections. [documentat…lpoint.com]
Also, if the business wants to ensure the values are set before granting access, one option could be to create a “NetSuite Account Enablement” access item/process that sets giveAccess=true and sendEmail=true. Once completed, users can request additional NetSuite roles/access normally. That said, if the requirement is specifically to prevent access from being granted when those attributes are not enabled, then the workflow/approval approach already suggested would be the appropriate control.