RBAC guidance with 100s of internal roles

Identity Security Cloud (ISC) ISC Discussion and Questions
1

We’ve been using ISC for some time (was IDN when we started) and primarily just for birthright access and AD roles.

We’ve taken on new systems since and provide access to these systems via entitlement allocation. We currently use Roles, and this works well for the small subset of users as its in pilot stage, but this doesn’t use any internal roles for the logic, just a training requirement.

Going forward this will be rolled out across the organisation and the end users internal role will dictate which entitlements are allocated (along with the aforementioned training). The crux of the issue is that we have 100s of internal roles and configuring all of these with the requisite logic (LCS, training, internal role) is very daunting.

My question is, what’s the best practice going forward to handle this large number of internal roles.

2

AND between groups, and OR within groups.

Always do it in the same order with the ‘must haves’ first followed by the role specific criteria. That way, when you export your role config from VSC, error checking becomes way simpler

3

it’s a very common challenge when scaling access provisioning in SailPoint Identity Security Cloud (ISC, formerly IDN). Here’s a breakdown of best practices and recommendations for handling hundreds of internal roles and associated entitlement logic in a scalable and manageable way.

Here are streamlined best practices:

  1. Use Dynamic Roles
    Define roles using user attributes (e.g., department, title, location, training) instead of creating one role per job. This reduces manual role management.
  2. Decouple Logic from Roles
    Track training completion via a user attribute. Don’t bake it into each role. This keeps logic centralized and maintainable.
  3. Leverage Access Request Policies
    For non-birthright access, allow entitlements to be requested based on user attributes like internal role and training status.
  4. Group and Rationalize Roles
    Combine similar internal roles into broader business roles. Aim to reduce 100s of roles to manageable access layers (base access, business function, conditional add-ons).
  5. Consider Layered Role Design
    Use tiers:
  • Base access (everyone)
  • Functional roles (based on job)
  • Conditional access (based on training/location)

This approach scales better and is easier to manage in the long term. Let me know if you need help creating a role mapping.

4

This topic was automatically closed 60 days after the last reply. New replies are no longer allowed.