New Capability: Management of Inactive Identities

[kirby_fitch]

@ktggks

Hey Kirby! Great presentation at Navigate on this. Looks like this broke our termination process. We have a 180 day account retention process after someone leaves the company. Much of that process is reliant on attribute sync. Have you considered a Medium Identity State which would allow attribute sync but removes them from everything else?

Hi @ktggks , sorry that I missed this message. You’re describing the purpose of the Inactive (short-term) identity state. Use that one until 180 days, and then move them to Inactive (long-term).

[kirby_fitch]

@DanMiddleditch

Can I just check if an Identity is in one of the inactive identity states, and they have entitlements attached to one of their accounts. Will they still be captured in any certifications that are run? Additionally, will any automated revocations still be processed as normal, or will these fail?

Hi Dan,

You should be able to do that with Search by combining a query for attributes.identityState and having entitlements. Inactives are still included in certifications. Automated revocations continue to be processed.

[ktggks (Sam Phan)]

Thanks for the response. We did update our Identity State to accommodate. We drop the identity profile after 190 days from the termination date so I’m not sure I see the benefit of moving to inactive (long-term) for 10 days. My comment was based on your presentation at Navigate with considerations to future changes to the Identity State. I guess it really matters on your definition of short-term vs long-term.

[Madhurimapati]

@kirby_fitch

Certifications

Any idea when this will be availble for certifications?

[chris-hogan]

Hi Kirby,

What about a re-hire use case in which the driving attribute already existed on the identity prior to them entering an inactive-long-term state? Say for example, a contractor has a start date for a future contract already on their identity, then the contractor is terminated. Their authoritative record is never updated, as the future date was already entered - without identity processing, and no updates from the authoritative source, would a date driven LCS transform ever get triggered? Would aggregations themselves be sufficient to set off the transform?

Thanks

[kirby_fitch]

I’d recommend keeping your recently terminated identities in inactive (short-term) for some period after separation. These identities get refreshed to cover use cases like this one.

If you really valued precision, you could also look into time-based refresh. That lets you pick the exact date-time the identity is refreshed again.

[adamslamena]

This would be a very nice feature, as it could simplify some of the role assignment criteria for us

[tysremi (Remi Tys)]

Hi Kirby,

We notice that we cannot filter on inactive (short or long) owners in the filters for Entitlement/Roles/Access Profiles in the Admin console.
Is this expected behaviour?
No doc specifies that it would also remove them from other picklists other than the request center.

Not being able to select them there makes it difficult to bulk update them.

[kirby_fitch]

Hi @tysremi - It’s true that that’s not currently supported. It would be best to vote on this idea!
https://ideas.sailpoint.com/ideas/GOV-I-4412

CC @PGookin