# SOD Auto remediation **URL:** \ **Category:** SHF Discussion and Questions\ **Tags:** sailpoint-identity-security, entitlements\ **Created:** [April 13, 2026, 9:06am UTC](https://developer.sailpoint.com/discuss/t/sod-auto-remediation/202344 "2026-04-13T09:06:58Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![PhilRawlings1](https://sea1.discourse-cdn.com/sailpoint/discuss/user_avatar/developer.sailpoint.com/philrawlings1/32/37266_2.png) [@PhilRawlings1](https://developer.sailpoint.com/discuss/u/PhilRawlings1)\ **Post date:** [April 13, 2026, 9:06am UTC](https://developer.sailpoint.com/discuss/t/sod-auto-remediation/202344/1 "2026-04-13T09:06:58Z")
Good morning all, We have a robust preventative SOD when access is requested through the correct channels (via ServiceNow). However, we are looking at remediating backdoor access. I’ve written a Powershell script that does the following: 1 - gets all SOD policies 2 - runs the violation report for each policy 3 - for each violation, checks which entitlement has been mostly recently added 4 - revokes that entitlement 5 - emails user and Line manager of what has happened We are still in the testing stage, but once complete, this script will hosted on a server, and run every hour. I feel that this is a good solution, but I am wondering if I can get any feedback, and/or if anyone else has implemented something similar, what route that took. Thanks ---
**Author:** ![baoussounda](https://sea1.discourse-cdn.com/sailpoint/discuss/user_avatar/developer.sailpoint.com/baoussounda/32/13095_2.png) [@baoussounda](https://developer.sailpoint.com/discuss/u/baoussounda)\ **Post date:** [April 13, 2026, 10:25am UTC](https://developer.sailpoint.com/discuss/t/sod-auto-remediation/202344/2 "2026-04-13T10:25:37Z")
Hi @PhilRawlings1 As you already has a strong preventative SOD in place. That mean those backdoor access will not be too much. And your approach is good in my point of view, but the only think I’m aware of is the decision making policy. If you have set of entitlements in both side in your SOD policies configuration would you always be able to check and detect the last entitlements ? I would pefer a kind of Interactive forms+worklows where for each violation, you can assign an interactive form to the manager or the violation owner and it can decide which access should be removed and workflows will do it automatically. Thanks. ---
**Author:** ![PhilRawlings1](https://sea1.discourse-cdn.com/sailpoint/discuss/user_avatar/developer.sailpoint.com/philrawlings1/32/37266_2.png) [@PhilRawlings1](https://developer.sailpoint.com/discuss/u/PhilRawlings1)\ **Post date:** [April 13, 2026, 12:29pm UTC](https://developer.sailpoint.com/discuss/t/sod-auto-remediation/202344/3 "2026-04-13T12:29:33Z")
Its the managers of the SOD policies who are either trying to back door access or are ignoring the tickets that are being created requesting them to make a decision. Interactive forms are an interesting way, but can leave a violation active for periods of time. In my opinion, any violation should immediately resolved. As the script is running frequently, it will always be able to check which entitlement is the most recent from this end point: $[tenant.api.identitynow.com/v2025/historical-identities/$IdentityId/events?startDate=$start&endDate=$end](http://tenant.api.identitynow.com/v2025/historical-identities/$IdentityId/events?startDate=$start&endDate=$end) Just compare the date stamp and revoke the most recent one ---
**Author:** ![ksbagade](https://sea1.discourse-cdn.com/sailpoint/discuss/user_avatar/developer.sailpoint.com/ksbagade/32/3306_2.png) [@ksbagade](https://developer.sailpoint.com/discuss/u/ksbagade)\ **Post date:** [April 13, 2026, 1:18pm UTC](https://developer.sailpoint.com/discuss/t/sod-auto-remediation/202344/4 "2026-04-13T13:18:49Z")
Hi @PhilRawlings1 Your approach to handling SoD policy violations is quite comprehensive and is a good solution in my opinion. However, one thing I might ask you to consider - setting up SoD email subscriptions in ISC This would reduce the overhead of your PS script by ISC sending the report via email. Additionally, if the option ‘Send the report even when there are no violations’ is disabled, it could further reduce execution times for each cycle. Hope this helps! ---
**Author:** ![PhilRawlings1](https://sea1.discourse-cdn.com/sailpoint/discuss/user_avatar/developer.sailpoint.com/philrawlings1/32/37266_2.png) [@PhilRawlings1](https://developer.sailpoint.com/discuss/u/PhilRawlings1)\ **Post date:** [April 13, 2026, 3:21pm UTC](https://developer.sailpoint.com/discuss/t/sod-auto-remediation/202344/5 "2026-04-13T15:21:59Z")
Hi @ksbagade Its an interesting idea wrt to the setting up subscription. The fundamental problem that I have with it, is that unless it is being run on a very frequent basis (my script is running hourly), the violation could exist for a significant period of time. I don’t think that our auditors would be happy with that. On top of that, i feel that its adding layers on complexity by trying to get a powershell script to respond to an inbound email containing a csv file (and by complexity, I mean I’ve no idea how to handle that off the top of my head) ---
**Author:** ![lampard08](https://sea1.discourse-cdn.com/sailpoint/discuss/user_avatar/developer.sailpoint.com/lampard08/32/32646_2.png) [@lampard08](https://developer.sailpoint.com/discuss/u/lampard08)\ **Post date:** [April 14, 2026, 11:06pm UTC](https://developer.sailpoint.com/discuss/t/sod-auto-remediation/202344/6 "2026-04-14T23:06:38Z")
As an alternative approach, have you considered NCD trigger and build your actions along? with this, you can either revoke access directly in ISC or call you powershell using PAG but i understand the pain in using workflows in few cases like loops or data transformations etc. > **[Native Change Account Updated - Workflow Triggers - SailPoint Identity Services](https://documentation.sailpoint.com/saas/help/workflows/workflow-triggers.html#native-change-account-updated)** > > When building a workflow, you'll always start with a trigger. | SailPoint Identity Services Documentation ---
**Author:** ![system](https://global.discourse-cdn.com/sailpoint/original/2X/f/f2136700ed5e3703e0b85e02f6be799dacca7735.png) [@system](https://developer.sailpoint.com/discuss/u/system)\ **Post date:** [June 13, 2026, 11:07pm UTC](https://developer.sailpoint.com/discuss/t/sod-auto-remediation/202344/7 "2026-06-13T23:07:03Z")
Closed on June 13, 2026, 11:07pm UTC This topic was automatically closed 60 days after the last reply. New replies are no longer allowed.