Restrict Attribute Sync

Identity Security Cloud (ISC) ISC Discussion and Questions
1

Hi Folks,

Would like to get your expert opinions on how to achieve following attribute sync requirement

  1. We have SuccessFactors as a HR source and creating AD account as a birth right application. We are using attribute sync to update AD attributes based on change in SF details. However, we would like attribute sync to work only for specific set of users ex. department=HR. Is it possible?
2

Hi Mahesh,

Sailpoint currently doesn’t support restricted/conditional/filtered attribute sync.

To achieve this you can either utilize the Update Provisioning policy of AD source and use a transform to check Dept value before updating attribute Or you could do the same using a Before Provisioning Rule.

1 Like
3

As @sharvari mentioned, no you cannot restrict sync like that. But there are ways

  • Add a Transform with condition, if department is HR then read data from AD account if not then read data from HR account.
  • With this approach, you will have same values for identity attribute and AD account attribute, so nothing to sync for HR department users. For other users, if data is different sync will trigger.

Only con here is you might need to create additional identity attributes but better than Before Provisioning Rule. What if you need to remove all the Attribute Requests in the Plan, that looks ugly rite and is cloud deployment, where as Transform is in your control.

Thanks
Krish

2 Likes
4

This is only possible via API today via the following /cc endoint: Postman

5

Hi Patrick,
Could you please elaborate how can we achieive the requirement using the API ?

6

Hi Mahesh,

In Transform we can exclude/Include the user by using accountPropertyFilter, please find below screenshot.

image

For more information please find below link:
https://developer.sailpoint.com/idn/docs/transforms/operations/account-attribute

7

Oh sorry, i am using web-service connector for SuccessFactors.
If you are looking for Direct SF connector. need to check.

8

Hi Mahesh,

I checked this approach will work for you as well. In Identity Profile add one attribute and tag your transform and use the same in SF Provisioning policy account mapping.
As @sharvari & @MVKR7T Said,
Just add the condition in the Transform as i posted initially. For required attribute which needed to sync back to SF.

Thanks,
Siva.K

1 Like
9

This topic was automatically closed 60 days after the last reply. New replies are no longer allowed.