Please share any images or screenshots, if relevant.
[Please insert images here, otherwise delete this section]
Please share any other relevant files that may be required (for example, logs).
[Please insert files here, otherwise delete this section]
Share all details about your problem, including any error messages you may have received.
I have a requirement to ignore birthright provisioning to a specific set of users and generate a work item for manual fulfillment. As part of this requirement, I need to prevent assignment of business roles during identity refresh. The customer has 1000+ business roles and its not possible to identify and alter the assignment rules to exclude the role assignment for this specific set of users. Is there any other efficient way to stop assigning business roles without altering the assignment rules?
@Ravikumar_Subramanyam : It’s not uncommon to have this kind of business requirement. From your description, I’m assuming that these are standard, out-of-the-box Business Roles, not “birthright” assignments in RapidSetup. Business Roles in IIQ will apply based on the assignment criteria (rule, match list, filter, etc.); however, one option to making a global update that would apply to all the Roles is to create a parent Business Role with the inclusion criteria and then make it the parent of all the other Business Roles.
In IIQ, a Business Role will inherit the assignment criteria of it’s parent, all the way up to the root. If their Role hierarchy is already structured with one or a few root levels, you could add the specific inclusion criteria into those. If not, this approach would still require updating the individual roles with a new parent.
For example, if their existing structure is flat:
Role A
Role B
Role C
Create a new Role and make it the parent of each of the current roles:
Role Alpha (with assignment criteria specific to who should get roles, excluding the users who should not)
Role A ← (updated with new parent)
Role B ← (updated with new parent)
Role C ← (updated with new parent)
If their existing structure already has some inheritance or folders:
HR Roles
HR Role A
HR Role B
HR Role C
IT Roles
IT Role A
IT Role B
IT Role C
C Suite Roles
VPs
Executives
In this case you could either add the criteria to the top level folders (change them from Organizational to Business Roles to do this), or you could create the new parent and then just update the inheritance of the current top level roles:
@ryan_coulter Thank you for your inputs. Since the customer have 1000+ business roles, updating the parent for all these roles is practically cumbersome. I’m looking for a rule or hook which enables to exclude the Role assignment during Identity Refresh Task(which evaluates the assignment rules of the business roles).
Hello Ravikumar. If you do not want to update 1000+ Business Role assignment rules, you can control this via the Identity Refresh task.
Automatic Business Role assignment is evaluated when “Refresh assigned, detected roles and promote additional entitlements” is enabled. You can limit that task using an identity filter or population, so only the identities that should participate in role assignment are processed.
You could split it into two refresh tasks:
normal users: role refresh option enabled
excluded users: role refresh option disabled, with the other refresh options they still need
This option also handles detected roles, entitlement promotion, and automatic role removal when assignment criteria no longer match. So, excluded users are effectively removed from that part of the role lifecycle (Identity-Refresh-Driven Assignments).
For a one-user/one-role exception, I would instead test normal LCM role removal and verify whether a negative RoleAssignment is created before relying on it.
This should stop assignment for certain set of users and can create a work item. I have never tested this, but this should work. Please give it a try and let us know for any further help.
Keep in mind that this only assures roles won’t be assigned to the excluded identities during that specific refresh task. If someone were to refresh one of the excluded identities using a single-identity refresh or some other process refreshes it (like a provisioning request), roles will then be evaluated and assigned.
Modification of the Identity Refresh workflow, as suggested by @neel193, would be a possible way to achieve the exclusion. However, keep in mind that this introduces non-standard and unexpected behavior into the system, making it more difficult to maintain in future upgrades. Be sure to document the customization very well.
If it’s a matter of how to make the needed update to all the roles, that could be done with a script.