When an IDN campaign or other provisioning “revoke” fails (events where “Remove Entitlement Failed”), trigger a work item (ideally in ServiceNow) for someone with adequate access to revoke the access. The work item should include as much information as possible including Identity Source Entitleme…

Hi @mrahulbb , You can achieve this with Provisioning Completed workflow trigger. You can use the below input to trigger it only for the certification related removal failures: $[?(@.action == “Certification”)].accountRequests[?( @.accountOperation == “Modify” && @.provisioningResult == “failed”)…

Hi @mrahulbb , I Think what @uday_kilambi post it’s a filter that you are going to put in a Workflow trigger of type Provisioning Completed. You will need to create an Workflow fort this to work, with the filter that @uday_kilambi sends you can then send the information to a email for exemple. Reg…

Can you please share me a search query for the above

Maybe you can use the Campaign Remediation Status Report, this will bring moust of the information that you want and the Status of the Event, if the access got remove or if we have any failure: Go to Cerfications > Campaigns and choose one Campaign then click on Download Report [image] And Downlo…

i am getting trigger filter error

$[?(@.action == “Certification”)].accountRequests[?( @.accountOperation == “Modify” && @.provisioningResult == “failed”)].attributeRequests[?(@.operation == “Remove”)] we have updated the above tigger filter in workflow but we are getting trigger filter errror.

Can you provide screenshot of the erro that you received. Query looks fine to me and it worked for me as well

Hey @mrahulbb , what @uday_kilambi suggested is create a “Workflow”, there are 3 things in Workflow, 1. Trigger 2. Action 3. Operators. When Workflow is created, first thing to configure is Trigger, which decides when Workflow will trigger. Uday has also provided you name of the Trigger to use. i…

Search query for the When an IDN campaign or other provisioning "revoke" fails (events where "Remove Entitlement Failed")

Identity Security Cloud (ISC) ISC Discussion and Questions

uday_kilambi (Uday Kilambi) June 25, 2024, 6:05pm 7

Hi @mrahulbb ,

If you need a search query to get the list of revocation failures for certification, it can be as below for Events:

“<source_name>” AND status:FAILED AND operation:REMOVE

But, it may not achieve an automated email initiation for failure, for that you need to go with workflow.

Regards,
Uday Kilambi

When Campaign revoke provisioning fails create SNOW ticet

Topic		Replies	Views
When Campaign revoke provisioning fails create SNOW ticet ISC Discussion and Questions workflows , identity-security-cloud , provisioning	1	35	May 7, 2026
Event Trigger with revoked items in a certification campaign ISC Discussion and Questions identity-security-cloud , event-triggers , certifications	4	165	July 27, 2025
Problem with Revoke entitlement operation in Webservice connector ISC Discussion and Questions webservice-connector , apis , rules , aggregation , identity-security-cloud , provisioning , certifications , connectors , entitlements , sources	28	615	September 3, 2024
How can I trigger a workflow when a user is removed from an Access profile ISC Discussion and Questions workflows , identity-security-cloud	3	156	December 10, 2024
Revoke Access Workflow ISC Discussion and Questions workflows , identity-security-cloud , provisioning	3	87	February 3, 2026

Search query for the When an IDN campaign or other provisioning "revoke" fails (events where "Remove Entitlement Failed")

Related topics