Hi everyone, I’m looking for guidance / sharing an approach for a recursive manager‑based role implementation in SailPoint Identity Security Cloud. Use Case If I am a manager, I want: Myself All managers under me (down the hierarchy) All their direct and indirect reportees …to be inclu…

I think a role like that would be better based on a position, than on a person. If you base it on a person, then the role criteria has to change whenever someone else fills your position. If that’s a requirement, then you need some automation outside of what comes with ISC. We’ve done something in …

The requirement is intentionally manager-based, not position- or department-based. Specifically, we need a way to dynamically identify all users who report to a given manager, both directly and indirectly. Anyone who falls below that manager in the reporting hierarchy must be included in the list a…

Is it possible to identify all direct and indirect users by using transforms on string-based attributes and then use that data in role criteria?

I don’t believe it is. You can search on isManager and then iterate over those results to determine who has that manager.name, but that’s not something you do in a transform. That’s a workflow or a script. It’s maybe achievable with some effort, but I still think that you’re trying to force ISC to b…

Well, ISC does not provide an easy way to look at someone’s org char. What you would have to do is set up a workflow: Triggered by external trigger with payload containing identity id set the role Find all users for whom manager id is our current user Call a new instance of this workflow…

Do you have a sample workflow or reference that demonstrates this kind of setup?

I think Workflows is overkill here, provided that: A) you can run a script that hits the API on a scheduled frequency B) your design can tolerate “reasonable” delays until eventual consistency is established. Create one new Identity Attribute managerSubTree Schedule the script to run slightly af…

Recursive Manager‑Based Role Assignment in SailPoint ISC

Identity Security Cloud (ISC) ISC Discussion and Questions

Pratyush27 (Pratyush Mishra) May 6, 2026, 2:14pm 8

I don’t have a 1:1 of your requirement because, well, it is quite unique. There is a concept blog for recursive workflow which can help you see where I am going: Recursive Workflows in IdentityNow

Topic		Replies	Views
Create a New Role which Includes all users with Direct Reports ISC Discussion and Questions identity-security-cloud , provisioning	10	272	September 13, 2024
Assigning roles based on a complex query ISC Discussion and Questions identity-security-cloud , roles	7	154	January 7, 2026
ISC Manager Certification Using Custom Reporting Manager Attribute ISC Discussion and Questions identity-security-cloud	8	95	June 2, 2026
Restricting a Role to only the direct reports assigned to them ISC Discussion and Questions rules , identity-security-cloud , roles , access-profiles	3	304	March 19, 2024
Query for all direct and indirect reports? ISC Discussion and Questions identity-security-cloud , search	2	535	April 19, 2024

Recursive Manager‑Based Role Assignment in SailPoint ISC

Related topics