Suggestions on contractor access approvals

Identity Security Cloud (ISC) ISC Discussion and Questions
, , ,
1

Hi everyone,
Currently, we have contractors on our engineering team. The contractors often work with our full time employee architect on various projects. However, in the HR system, the contractor’s manager reports to a manager who also happens to be a contractor.

Often, multiple contractors report to a single manager contractor that isnt part of their day to day activities.

Issue:
When contractors submit access requests via sailpoint request center, the approvals are sent to their contractor manager who isnt aware of their day to day activities. This ends up causing delays in approvals and lack of information.

Is there any feasible solutions for this issue?

Option 1: We might have to convert the contractor manager’s to full time employee manager in the hr system.

Option 2: Any way to have access approvals route to a full time employee (architect) when contractors submit access request?

I am open to hear other suggestions or if there were other ways this was implemented!

Thank you!

2

I would setup a Work Reassignment on the Contractor Manager’s identity so that Access Requests and Certifications go to full time employee.

3

Thank you, Carl. That makes sense. However, there are about 50 contractors that report to a single contractor manager. Now the work re-assignment would send all their access approvals to the single full time employee.

The contractors work with various engineering full time employee architects.

I was wondering if there are any workflows that can be used here? Depending on an identity attribute, it routes to certain users by-passing managers.

4

Unfortunately there aren’t Workflow triggers or actions that would work for this.

I can think of 2 options.

  1. Change the Contractors manager in your Authoritative Source
  2. Transform the Manager identity attribute:
  • Add a new attribute in your Authoritative Source (or could be in any source) which contains the ID of the desired approver (make sure it is the same ID format of the original manager attribute).
  • Create a First Valid transform, if new attribute is populated use that, otherwise use the original manager attribute.
  • Apply the transform to the Manager Identity attribute.

Just make sure to test if you do option 2 to make sure the new Manager is linked properly in ISC.

1 Like
5

Thank you, I think that is definitely a better solution!

1 Like