New Capability: Management of Inactive Identities

[kirby_fitch]

Hi Pinkey,

We had some trouble deploying the identityState attribute to FedRAMP and are working on that. We do try to keep our FedRAMP schedule lined up with the commercial schedule. Sorry for the wait! I’ll reply to this message again when it’s done!

[kirby_fitch]

Hey y’all, updates on feature rollout!

Commercial (non-FedRAMP) tenants

• We’ve rolled this out to the first two segments of production tenants.
• We’re targeting a rollout to our largest and final segment of production tenants on Monday.
• Check in Monday afternoon (US Central time) if you didn’t receive it yet.

FedRAMP tenants

• We’re targeting a sandbox release as soon as we’re able. Sorry for the delay.

I know you’re all waiting for this feature. I’ll keep updating this thread. Thanks for your patience!

Also, tune in on Wednesday for a feature setup talk at Developer Days!

Quick start: management of inactive identities

[Quick start: management of inactive identities] Description Are you tired of people requesting access for inactive identities? Are your managers tired of seeing inactive identities in the manager view? Do you wish that the Apply Changes button did it’s thing faster? 330+ voters answered YES to these questions in one of our top-voted ideas. Join us to learn how you can spend just MINUTES to solve these problems with the new Management of Inactive Identities capability.

[ajtardio]

Thoughts on the UI for the Home or “My SailPoint” dashboard which has a My Team widget - the total number includes Inactive Identities. This will be a little misleading for a Manager who knows they only have 5 direct reports but shows 20 because of Identities that are Inactive.

Should the new widget only show the count of Active Identities on “My Team”?

[kirby_fitch]

@ajtardio

Should the new widget only show the count of Active Identities on “My Team”?

Hi @ajtardio - good catch. This was an oversight on our part. I noticed it the other day and submitted a ticket to address it. @Tyler_Harman and team will resolve it soon!

[chirag_patel]

@kirby_fitch

attributes.identityState:INACTIVE_SHORT_TERM

Thanks for this great enhancement.

Wanted to highlight minor missing functionality. “Identity state” as an attribute is missing in column chooser when we search for identities. While troubleshooting I was seeing inactive short term identities in request centre and wanted to confirm if they were actually in that state or not , processing delay can cause this in staging environment.

Search is easy way to look for things in faster way instead of clicking on multiple identities in identity screen.

[PRIYANKALINGALA]

On Home page we are able to see the count of all the users but once we click on My Team we are seeing the count based on active Identity state, also if we search the user who is part of Inactive short term or inactive long term we are able to see the user details. Let us know if this is the expected behavior?

Thanks in advance.

[johnepic (John Gibbons)]

In addition to the new attribute not being selectable as a column in search results, it also is not available when defining role criteria. I’m sure this is also an oversight, but I’d love to see that corrected.

[kej01s (Kathryn Sanders)]

What happens with attribute sync? Our HR team can be a bit slow in updating some of the attributes for ex-employees. I don’t want to mark our “Inactive” lifecycle to “Inactive long-term” if it will cause these identities not to receive attribute syncs. I think I should initially mark this as “inactive short-term” and then create a new lifecycle type for 90 days inactive for attribute sync. See below

LC Name Setting
90 day inactive Inactive (short-term)
Inactive (>90 day terms) Inactive (long-term)

Thoughts?

[kirby_fitch]

Hi @chirag_patel,

Thanks for this. We’re aware it’s missing there. If you visit Identity Management > Identities, you are able to add Identity State as a column in that list.

[kirby_fitch]

@PRIYANKALINGALA

Let us know if this is the expected behavior

Hi @PRIYANKALINGALA,

We’re expecting this to count just identities that are ACTIVE. Sorry for the oversight. We’re working to correct this.

CC @Tyler_Harman

[kirby_fitch]

@johnepic

In addition to the new attribute not being selectable as a column in search results, it also is not available when defining role criteria. I’m sure this is also an oversight, but I’d love to see that corrected.

Thanks, @johnepic. Good call-out. We’re looking into this one.

[kirby_fitch]

@kej01s

What happens with attribute sync

Hi @kej01s, we haven’t implemented a filter yet on Attribute Sync but here’s how we’re going to do it:

New Capability: Management of Inactive Identities

Hi @jahumada22, Thanks for the input. This will be an up-next priority for us. A couple specifics, Jonathan. How does this design sound? Attribute sync will always be triggered for Active and Inactive (short-term) identities. Attribute sync will not be triggered for Inactive (long-term) identities… After identity attributes have been changed. After account attributes have been changed. After administrators use bulk sync for an entire source (/beta/sources/:id/synchronize-attributes). Attri…

Creating a two-step termination the way you propose would be a suitable solution to the problem. We wrote the specification with the intent you’d do it just like that!

[CMeiding (Cheri Meidinger)]

Will you be looking at change the color scheme on the headings (maybe make them the bright blue that the tabs show when they are highlighted) or making them larger so that they are more easily distinguishable? I find the new view hard to read. I do like the search attributes field. I would also like to be able to select the single/Multiple view and have it stay as my preference rather than have only Single as default.

[kirby_fitch]

I think this is feedback about the Identity Management UI rather than Inactive Identity Management. That’s OK, I know what you’re asking about!

@CMeiding

Will you be looking at change the color scheme on the headings (maybe make them the bright blue that the tabs show when they are highlighted) or making them larger so that they are more easily distinguishable? I find the new view hard to read.

Could you send us a screenshot (with drawing, highlighting, etc.) that shows us what UI elements you’re having a hard time reading?

@CMeiding

I would also like to be able to select the single/Multiple view and have it stay as my preference rather than have only Single as default.

I filed a ticket with the team for this one CC @spencer_harder @willcashman

[kirby_fitch]

@johnpaul_tran

Is it possible to include the new attribute when you do an export from the IdentityList UI view? I don’t believe I see the attribute in the csv file.

This work just wrapped up in a development environment. We’ll be rolling this out relatively soon.

[SPIDMG (Craig Richard)]

One area that we constantly run into issues with is terminated users that had roles assigned to them via a ServiceNow request. Without submitting requests by managers to remove the roles granted to the former user, the role gets ‘sticky’ and no matter what we do, they keep coming back. Is there any consideration, for either short-term or long-term, to have it wipe any roles assigned to the former user? This would make cleanup so much easier.

[kirby_fitch]

Here’s the revised Identity > Export report!

[kirby_fitch]

@SPIDMG

Is there any consideration, for either short-term or long-term, to have it wipe any roles assigned to the former user? This would make cleanup so much easier.

Hi Craig, I think it’d be great to do the following:

When identities move to INACTIVE_LONG_TERM, remove roles, access profiles, and entitlements that were requested.

Does this sound good to you?

Are there others in the community who would find this useful?

CC @PGookin @jennifer_mitchell @willcashman

[beth_wu (Sharron Wu)]

Yes! This would be a great enhancement for my organization as well.

[SPIDMG (Craig Richard)]

Exactly! Especially since we assign some roles through ServiceNow API calls, and unless we open a ticket to remove the roles, they get stuck there.