Hi Everyone,
Does ISC SDIM support data segmentation similar to the data segmentation functionality available in the ISC Request Center?
@VS05 No, ISC SDIM Data Segmentation is not the same as the Request Center Access Request Segmentation feature.
In Identity Security Cloud, Access Request Segments are used to control which access items (roles, access profiles, entitlements) are visible and requestable by specific groups of users in the Request Center.
SDIM/Data Segmentation, on the other hand, is designed to provide record-level visibility controls for administrative data, allowing organizations to restrict which administrators can view and manage specific objects. The initial GA release primarily supports Entitlement Administration and is focused on delegated administration and least-privilege access.
So, if your requirement is to limit what end users can see and request in the Request Center, use Access Request Segments. If your requirement is to limit what administrators can see and manage within ISC, use Data Segmentation (SDIM).
Hello Vinita. SDIM doesn’t have its own segmentation feature. It operates at the provisioning layer, converting ISC provisioning actions into tickets in whatever service desk system you’ve configured (ServiceNow, Jira, etc.). Those provisioning actions can come from access requests, lifecycle state changes, role assignments, or other provisioning processes. Segmentation happens upstream from all of that.
The feature you are probably thinking of is Access Request Segments (Admin > Access Model > Segments). These control which roles, access profiles, and entitlements are visible and requestable by specific groups of users in the Request Center. When a source uses SDIM for provisioning, the segment filtering still happens in the Request Center before any provisioning action is generated. SDIM then picks up the resulting provisioning action and creates the ticket.
Data Segmentation (Admin > Global > Data Segmentation) is a separate feature entirely. It scopes which entitlements and roles non-Org Admin users can see and manage in the ISC admin UI. It’s for delegated administration, not for controlling what end users can request. It has nothing to do with SDIM or the Request Center.
If you are using the ServiceNow Service Catalog integration (which is a separate app from SDIM): segmentation behavior there depends on how you have set up the OAuth connection. With the authorization_code flow, the real ISC user’s context is used, but access request segmentation won’t be applied when browsing the catalog. It only gets enforced on submission, so users can see unsegmented items but get an error if they try to request something outside their segment. With client_credentials, all requests go through a single ORG_ADMIN service account, so ISC-side segmentation doesn’t apply at all.
Thanks @Pankaj_IAM_SailPoint
Thanks @punna0001 for the information