Send an email notification and SNOW ticket create and manage

[suraj_gorle]

Hi @kalyannambi2010 ,

Since Keeper is managed through Azure AD groups and there is no direct Keeper connector, I would handle this through an ISC Workflow.

You can trigger the workflow based on the provisioning event and filter for the specific Azure AD source/group removal, for example when the Keeper-related group is removed as part of UAR or termination.

The workflow can then:

1. Detect the removal of the Keeper Azure AD group.

2. Create a ServiceNow ticket using the Manage ServiceNow Ticket action (or an HTTP Request if you need a custom ServiceNow API).

3. Include useful details such as user identity, removed group, request/termination context, and any other information required by the Keeper team.

4. Send an email notification to the Keeper support/team with the ServiceNow ticket number.

5. Optionally monitor the ServiceNow ticket and send a follow-up notification when the ticket is completed.

Using the Manage ServiceNow Ticket action is preferable if you want ISC to maintain/manage the ticket lifecycle. SailPoint’s workflow approach also provides more flexibility for filtering specific identities, sources, and provisioning scenarios compared with the standard ServiceNow Service Desk integration.

The important part would be getting the provisioning-event payload first and confirming the exact JSON attributes exposed for the Azure AD group removal. Once that is confirmed, the workflow filter can be built specifically for the Keeper group rather than creating a ticket for every Azure AD group removal. Please refer below thread for reference.

SailPoint ISC - Best Approach for Notifying Group Owners/Concerned team After Certification-Based AD Group Removal

Hi @rajrout2024, I came across a similar use case where I needed to disable an account when access was revoked through a certification. To achieve this, I used a Provisioning Completed trigger to capture the event and then filtered it based on the action received in the trigger. I know your use case is a bit different, but I thought I’d share this approach in case it helps. I’ve attached a screenshot of the workflow for reference. [DisableAccountonAccessRevocationviaCertification20260610] T…

If you don’t have SDIM available, the same approach can be implemented through Workflow + ServiceNow API/Service Catalog API, although ticket-status tracking requires some additional workflow logic.

Hope this helps.