Policy violation needs to be checked for pending access request

IdentityIQ (IIQ) IIQ Discussion and Questions
1

For policy violations in sailpoint iiq, it does not look for pending requests for the conflicting role, is there a way to customize to look for the pending requests raised by the user

2

Yes you can use an Advanced Policy and search for pending requests that would cause a violation

Or can implement a subsequent policy violation step within your LCM Provisioning workflow to check for violations after requests have been approved before provisioning

1 Like
3

Hi @PearlyneMRC ,

It depends on your requirement .

If you need for one or two policies , then you can use advance Policy .

But if you need this on framework level , where your existing policy also starts checking then i would suggest to look in to “Identity Request Violation Review“ workflow , see if we can customize there .

Just an idea , Explore it . we can discuss further if needed.

4

Hi there!

This is by design. as the access is not yet “realized”, the risk isn’t either.

You could Customized to check , but it will trigger a conflict after the approval happens.

5

@PearlyneMRC Have you tried creating the Advanced Policy? You might want to create a configurable policy with all metadata stored in external object like Custom objectwhich you can use it further to extend for any apps and applications.

Note: Found a fix?Help the community by marking the comment as solution. Feel free to react(:heart:,:+1:, etc.)with an emoji to show your appreciation or message me directly if your problem requires a deeper dive.