Remove entitlements while disable

Identity Security Cloud (ISC) ISC Discussion and Questions
, ,
2

Hi @Amsingh1 ,

Yes you can configure this behavior per source using the ‘Services Standard Before Provisioning Rule’. You can have SailPoint support deploy this rule to your tenant (if not already available). Once deployed, you can patch individual sources with a json map describing the triggers & actions you would like to utilize from the rule (ie. remove all entitlements on a disable operation).

See below for an example config you can patch onto a source to remove ‘group’ type entitlements on a disable operation. You need to patch the cloudServicesIDNSetup config as well as the beforeProvisioningRule attributes onto the source:

            "cloudServicesIDNSetup": {
                "eventConfigurations": [
                    {
                        "eventActions": [
                            {
                                "Action": "RemoveEntitlements",
                                "Attribute": "group",
                                "Value": null
                            }
                        ],
                        "Operation": "Disable"
                    }
                ]
            }

        "beforeProvisioningRule": {
            "type": "RULE",
            "id": "<rule id>",
            "name": "Services Standard IdentityNow BeforeProvisioning Rule"
        }

Let me know if that helps!

Thanks,

Liam