I have a use case in SailPoint ISC where an identity needs to retain a subset of entitlements after the role that originally granted them is removed.
For example, Identity A is assigned Role A, which contains:
Entitlement A
Entitlement B
Entitlement C
Entitlement D
During a mover event, Role A will be removed and Role B will be assigned. However, the identity still requires Entitlements C and D in the new position.
How can we prevent Entitlements C and D from being deprovisioned when Role A is removed?
In this client’s context, the identity supports critical, client-facing services, so the business cannot accept even a temporary removal and reprovisioning of these entitlements. The objective is to retain Entitlements C and D permanently and without interruption.
Submitting a separate access request before removing Role A does not appear to work because the entitlements are already assigned through Role A. Is there another supported approach in ISC to establish a new assignment source or retain these entitlements before the role is removed?
Hello Joshua. You could include Entitlements C and D in Role B, or in another role that stays assigned. Assign the new role first and confirm the assignment before removing Role A.
ISC retains entitlements that overlap with another assigned role, so there should not be any removal/reprovisioning gap. This is documented here.
I would suggest validating the full sequence in a sandbox first to confirm it works as expected in your setup.
A common approach is to make sure Entitlements C and D have another assignment source before Role A is removed.
For example, move C and D into a separate role or access profile and assign that first. Then, when Role A is removed, ISC still sees a valid source for those entitlements and won’t deprovision them.
In my experience, if uninterrupted access is required, separating the shared entitlements into their own role/access profile is usually the cleanest and most sustainable solution.
Understood your suggestion, but it does not really solve the problem as each identity has its own set of “delta” entitlement.
Identity A has Entitlement C and D. Maybe next Identity B has Entitlement A and B instead. Every identity has possibility of having different combination of entitlement to retain.