Remove correlation between an account and an Identity - “manuallyCorrelated” set to TRUE

Identity Security Cloud (ISC) ISC Discussion and Questions
1

Hello,

We have two authoritative sources, one for employees(Oracle HCM) and one for contractors(NERM). Account correlation is based on the Peron IDs on these systems.
When a contractor converts to a full time employee, the person ID on the account is changed to the HCM Person ID, but it is still linked to the NERM identity.
We have realized that when the provisioning of an account is done via ISC, the account has the field “manuallyCorrelated” set to TRUE and remains attached to the NERM Identity.

Is there a way to remove the correlation between and Identity and an account and set the field manuallyCorrelated to False, so that it is linked to the correct employee identity?

We do not require a manual workaround because we have a lot of users for whom we would like to link their accounts to their new identity automatically.

Thanks

2

Hi @Madhurimapati,

You need to check the priority of your two authoritative sources identity profiles and ensure that the Employees source has a higher priority than the Contractors source. This way, SailPoint Identity Security Cloud (ISC) will always assign the identity to the profile with the highest priority when there are multiple matches.

To do this, you can use the List Identity Profiles API to view the current priorities.

image
image738×107 6.09 KB

Then, you can use the PATCH API to update the priority if needed update-identity-profile | SailPoint Developer Community

Let me know if you need help with the exact API request syntax.

1 Like
3

Thanks @baoussounda - Will the accounts also be correlated to the correct identity and move from the Contractor source to the Employee source?

4

Yes @Madhurimapati it will move and correlated correctly.

5

Old Identity accounts will not be moved to new Identity because of this flag manuallyCorrelated: true

The reason ISC sets it as true is, if an account moved to different Identity, a new account provisioning will trigger for the old identity due to Automated Roles or Requested Access, which will create duplications. To avoid that ISC setting it as true, if it is true, aggregation process will not re-calculate.

  1. Delete those accounts from old Identity, when you run aggregation next time, it will calculate correlation again and move to new identity.
  2. Set this flag as false using some customizations.

For customizations, you can utilize either workflows or APIs, if you go with APIs, you can run those Scripts in IQ Service.

1 Like
6

This topic was automatically closed 60 days after the last reply. New replies are no longer allowed.