Hi All, I have configured workflow which removed the entitlement when user lifecycle state changes from Inactive to Terminated. Detect Trigger Get Access : Entitlement Using Loop with LoopInput : $.getAccess.accessItems[*] Manage Access : Request Type : REMOVE But I want to remove, Role + Access Profile + Entitlement (ALL) I tried to check mark all the options (Get Access Profiles + Get Roles + Get Entitlements), but no luck. I tried differnet workflow using the HTTP Request but that does not remove the birthright access. Requirement is to removes all the access (birthright + access requested) Please assist

Hey Ritika, When you say: [image] Ritika K: I tried to check mark all the options (Get Access Profiles + Get Roles + Get Entitlements), but no luck. Do you mean you don’t get all the accesses ( ent + role + access profile ) or are you not able to remove those accesses?

Hi Zeel, I am not able to remove

Any error message you get? Might help to debug the issue.

This use case can be handled using 3 steps: Use Identity profile config to auto remove entitlements for sources. Use before provisioning rule to remove residual entitlements. Use this workflow to remove all sticky Roles and other access items by submitting revoke access request. Workflow - Remove Entitlements from selected source - #7 by colin_mckibben

[image] User has : 1 Role, 4 Ent and 1 AP Config, [image] [image] [image] [image]

@RitikaK After Get Access action, can you directly pass on the input to Manage Access action instead of looping using loop operator? [image] Reference Also please check the JSON input to the Mange Access Action for troubleshooting Thanks

Hi @RitikaK Having problem when tried to remove all access. The fact is that Manage Access input should be the Get Access output, and there is a limitation of revoking only one entitlement at a time. Your approach is fine, you have only to change 4 - Managge access for an HTTP Request action, on which it calls the ISC API to remove each account. [image] [image] [image] [image] In this case, JSON body should be: {"requestType":"REVOKE_ACCESS","requestedFor":["{{$.loop.context.id}}"],"requestedItems":[{"comment":"Usuario Desligado","id":"{{$.loop.loopInput.id}}","name":"{{$.loop.loopInput.name}}","type":"{{$.loop.loopInput.type}}"}]} note that I changed names to be more readably, but Get Entitlements is a Get Access action. As you need to revoke all types, you can make 3 HTTP Request actions in cascade, each with each type hardcoded (with 2 string compare operations checking what type comes in the loop item).

with reference to, Remove all entitlements with workflow - Identity Security Cloud (ISC) / ISC Discussion and Questions - SailPoint Developer Community is this correct approach to remove both Ent and AP in Loop Input? $.hTTPRequest.body[0].access[?(@.type == “ACCESS_PROFILE” && @.type == “ENTITLEMENT”)]

@RitikaK this is what you need [image] Workflow to remove ALL leavers' standing access ISC Community Knowledge Base Hi everyone, This workflow auto-revokes any standing access leavers have either through a micro targeted access certifications or by leveraging revoke access requests after being terminated. This should ensure that all leavers’ access is removed upon terminated and not just access assigned through birthright roles. Additionally, an audit trail is generated to document when and why the access was removed. This workflow was designed and built with the help and input of a multiple people! Thank… Best!

@RitikaK no, because each body call must be ENTITLEMENT OR ACCESS_PROFILE OR ROLE. That’s why you should follow this approach, with the difference to have 3 HTTP Request, one for ENTITLEMENT, other for ACCESS_PROFILE and other for ROLE.

Remove all Access when user state changes from Inactive to Terminated

SailPoint Human Fabric (SHF) SHF Discussion and Questions

ipobeidi (Ivan Obeidi) September 23, 2024, 3:37pm 12

@RitikaK this is what you need

Best!

Topic		Replies	Views
Need Help with Workflow to Remove Access Profile and Entitlement on User Inactivity or Information Change SHF Discussion and Questions workflows , sailpoint-identity-security , access-profiles , entitlements	16	1475	June 25, 2024
When inactive, remove entitlements or access profile SHF Discussion and Questions workflows , sailpoint-identity-security , entitlements	1	680	December 11, 2023
Workflow - Remove Entitlements from selected source SHF Discussion and Questions workflows , sailpoint-identity-security , entitlements	17	2919	August 25, 2023
Termination workflow to remove requestable access profiles and roles SHF Discussion and Questions workflows , sailpoint-identity-security , access-requests	6	676	September 10, 2024
Remove access from workflow SHF Discussion and Questions workflows , sailpoint-identity-security , roles	22	3005	July 11, 2023

Remove all Access when user state changes from Inactive to Terminated

Related topics