Role is removed from a user in ISC, but access profile and entitlement remains

[haou1407 (Fadzlynna Fadzil)]

Hello,

We encountered an issue in Identity Security Cloud (ISC) where a role was removed from a user, but the access profile and entitlement linked to that role still remain.

What could be the possible causes of this?
How can we troubleshoot it effectively?

Additional Information:

• We have already tried manually processing the identity.

• We also manually aggregated the source entitlements.

• The issue still persists.

  • Error message:
    • [“sailpoint.connector.ConnectorException: Message Status(500) Error response from connector: Unable to execute request to URI https://owprod.api.identitynow.com/beta/connectors/get-object?objectClass\\u003dApplication\\u0026objectNameOrId\\u003d2c9180867ce6705e017ced8ee8730ed5”\]

• AP and entitlement remain, expecting for them to be removed together with the role

Looping @fayolaph for visibility.

[Abhinov7 (Abhinov Dhonthula)]

Hi,

I think when tried to remove entitlement it got error on connector side, so couldn’t remove the entitlement. Access Profile will automatically detect if you have the entitlement.

First check the issue with connector. Also can you specify for which source you are getting issue?

-Abhinov

[haou1407 (Fadzlynna Fadzil)]

Hi Abhinov, thanks for the response.

I’ve done Test Connection on the source, and it was successful.
The source status is Healthy too. Source is Azure Active Directory.
It’s not happening for other roles though, only for this role.

Regards

[Abhinov7 (Abhinov Dhonthula)]

Yes,

I think there is an error while remove azure entitlements. Can you check if all the required permissions are given to the azure service account.

-Abhinov

[haou1407 (Fadzlynna Fadzil)]

Would you be able to give me the steps to check on the Azure service account?
I don’t seem to see it under the Azure Active Directory configuration.

Thanks!

[Abhinov7 (Abhinov Dhonthula)]

Please go through below document.

Required Permissions

Add all required permissions. Also what is the entitlement type you are trying to remove.

-Abhinov

[PhilRawlings1 (Phil Rawlings)]

Hi,
Sounds like a case for a quick recertification to get rid of the accessProfiles

[vdivakar (Vaibhav Divakar)]

@haou1407 if this is happening only for this role, meaning, only for the Entitlements added in this role, then may be the service account does not have sufficient privileges to remove any users from this entitlement in the Azure, I would definitely check the permissions required for the service account in order to successfully remove users from the security groups.

[haou1407 (Fadzlynna Fadzil)]

Hi @Abhinov7 ,

This might be a sticky entitlement.
Is there any way to find anymore sticky entitlements?

Also, here are the permissions.

Thanks!