I have an Identity with two accounts on the same application:
Account 1: Normal/primary account
Account 2: Additional account
I assigned a Business Role to Account 1. However, when I try to assign the same Business Role to Account 2, SailPoint indicates that the role is already assigned.
From my understanding, the Business Role is assigned at the Identity level, rather than being assigned independently to each account/link.
My question is:
Is there a supported way in SailPoint IdentityIQ to assign the same Business Role to both accounts/links of the same application?
For example:
Identity → Application
Account 1 → Business Role X
Account 2 → Business Role X
Or is this expected behavior because the Business Role can only be assigned once at the Identity level?
If this is not supported, what would be the recommended approach for handling this use case with additional accounts?
@IslamElkhouly You are right roles are assigned at identity level and underlying entitlement can be assigned to one account. What you can do is you can configure two roles:
Role 1 + Ent1-> have account selector to assign to account1
Role2+ Ent1 with assignment criteria to check if Role1 is assigned or not → add account selector to assign to account2. So, if it satisfy the criteria, both roles will be assigned and underlying entitlements will be assigned to both accounts.
@IslamElkhouly Another option you can try is to have a before provisioning rule to modify the plan to add another account request to assign the same entitlement to the other account. Also keep this option in your evaluation.
Hello Islam. You do not need a duplicate role or a Before Provisioning rule for this. IIQ handles it natively.
Under the global Role settings, enable Show user interface option to allow multiple assignments, then set Enable multiple assignments on the Business Role. The same role can then be assigned to the identity more than once, each assignment targeting a different account (Multiple Role and Account Assignment).
Add an account selection rule if you want IIQ to pick the account automatically. Without one, an LCM request can prompt the requestor to select the target account when multiple accounts exist.
@IslamElkhouly you can make the change in configuration under global setting–>identity iq configuration–>roles
enable option to assign role multiple time.
