Trigger certification for entitlement owner : AD Source

Identity Security Cloud (ISC) ISC Discussion and Questions
,
1

Hi All,

I hope all doing well.

We have a list of users for whom we need to trigger a certification. The search query is:
source.name:"Active Directory" AND value:"OU=OID Agencies,OU=Roles,OU=Applications,DC=**,DC=**,DC=**,DC=**"

Each entitlement has a different owner. We want to trigger the certification for the entitlement owner, not the manager, in SailPoint Identity Security Cloud (ISC). I am new to ISC workflows. Could someone please guide me on how to achieve this? Also, when the certifier revokes access, it should be removed automatically. Please help.

2

Hi @Venu1010

Unfortunately entitlement owner certifications are not supported out of the box at this moment. Here is the thread where this is being requested repeatedly:

3

can we do it with workflow?

4

Hey @Venu1010 ,

Your source owner is different from entitlement owner?

5

I have done this using PS Script running outside of ISC.

6

yes Each entitlement has different owners. please suggest

7

what is it? Could you please explain and guide me too as well.

8

image
image1617Ă—838 63.4 KB

9

2 options

  1. Create a review for each entitlement separately, If the count of entitlement is large it could be nightmare
  2. Use the external PS script to run the review ( recommended way this use this earlier to generate EO review)
10

external PS script to run the review how to do this. I am new to this pls guide

11

Hi @Venu1010 ,

You can utilize the SailPoint Certification API to generate certifications through a PowerShell script for each entitlement, keeping the reviewer as the entitlement owner.

12

Check the PS SDK and try to setup in local

13

If this is a new engagement, with SailPoint’s involvement, maybe reach out to the CSM team to get the ruby script from SailPoint’s PS.

They have a ruby script that does access object’s owner certification (specifically to reassignment certification items).

If not, you can vibe up a script to call the powershell cmdlets.

14

what is CSM team ?is this the sailPoint Team

15

You can reach them at:
customersuccess@sailpoint.com

Specifically, the keywords you want to mention to them is “Bulk Certification Reassignment to Object Owner”. It was at version 1.0 back in 2024 Aug 2nd.

Note that this will count towards your monthly API quota…so depending on the certification campaign size and frequency, it might become something you need to factor into.