Hi All, I have configured workflow which removed the entitlement when user lifecycle state changes from Inactive to Terminated. Detect Trigger Get Access : Entitlement Using Loop with LoopInput : $.getAccess.accessItems[*] Manage Access : Request Type : REMOVE But I want to remove, Role + Access…

Hey Ritika, When you say: [image] Ritika K: I tried to check mark all the options (Get Access Profiles + Get Roles + Get Entitlements), but no luck. Do you mean you don’t get all the accesses ( ent + role + access profile ) or are you not able to remove those accesses?

Hi Zeel, I am not able to remove

Any error message you get? Might help to debug the issue.

This use case can be handled using 3 steps: Use Identity profile config to auto remove entitlements for sources. Use before provisioning rule to remove residual entitlements. Use this workflow to remove all sticky Roles and other access items by submitting revoke access request. Workflow - Remove …

[image] User has : 1 Role, 4 Ent and 1 AP Config, [image] [image] [image] [image]

@RitikaK After Get Access action, can you directly pass on the input to Manage Access action instead of looping using loop operator? [image] Reference Also please check the JSON input to the Mange Access Action for troubleshooting Thanks

Hi @RitikaK Having problem when tried to remove all access. The fact is that Manage Access input should be the Get Access output, and there is a limitation of revoking only one entitlement at a time. Your approach is fine, you have only to change 4 - Managge access for an HTTP Request action, on w…

with reference to, Remove all entitlements with workflow - Identity Security Cloud (ISC) / ISC Discussion and Questions - SailPoint Developer Community is this correct approach to remove both Ent and AP in Loop Input? $.hTTPRequest.body[0].access[?(@.type == “ACCESS_PROFILE” && @.type == “ENTITLE…

@RitikaK this is what you need [image] Workflow to remove ALL leavers' standing access ISC Community Knowledge Base Hi everyone, This workflow auto-revokes any standing access leavers have either through a micro targeted access certifications or by leveraging revoke acces…

@RitikaK no, because each body call must be ENTITLEMENT OR ACCESS_PROFILE OR ROLE. That’s why you should follow this approach, with the difference to have 3 HTTP Request, one for ENTITLEMENT, other for ACCESS_PROFILE and other for ROLE.

Remove all Access when user state changes from Inactive to Terminated

Identity Security Cloud (ISC) ISC Discussion and Questions

ipobeidi (Ivan Obeidi) September 23, 2024, 3:37pm 12

@RitikaK this is what you need

Best!

Topic		Replies	Views
Need Help with Workflow to Remove Access Profile and Entitlement on User Inactivity or Information Change ISC Discussion and Questions workflows , identity-security-cloud , access-profiles , entitlements	16	1148	June 25, 2024
When inactive, remove entitlements or access profile ISC Discussion and Questions workflows , identity-security-cloud , entitlements	1	651	December 11, 2023
Workflow - Remove Entitlements from selected source ISC Discussion and Questions workflows , identity-security-cloud , entitlements	17	2646	August 25, 2023
Termination workflow to remove requestable access profiles and roles ISC Discussion and Questions workflows , identity-security-cloud , access-requests	6	573	September 10, 2024
Remove access from workflow ISC Discussion and Questions workflows , identity-security-cloud , roles	22	2689	July 11, 2023

Remove all Access when user state changes from Inactive to Terminated

Related topics