Triggering PowerShell on IQService from an ISC Workflow!

Identity Security Cloud (ISC) ISC Discussion and Questions
1

I’m trying to mail‑enable an AD group via Exchange Online. I have a PowerShell script on the IQService server that handles the Exchange Online connection and the mail‑enable operation. What methods or best practices exist for triggering this PowerShell script directly from an ISC workflow?

Please share approaches that you’ve actually executed successfully in ISC.

Thanks,
Pravin

2

Hi,

Try Webhook/HTTP API layer or by embedding the logic into the Active Directory connector’s native After Provisioning/Modify Rule.

3

Hi @pravin_ranjan,

I’ve used PTA in workflows for this use case frequently. However, I typically execute the PowerShell scripts from a separate Windows server, so I can’t confirm if direct execution from the IQService host is supported.

Here are a few resources that might help you get started if you want to try this route:

Example Use Case
Building a Custom Identity Timeline Report

Official Documentation
Privileged Task Automation

Let me know if you have any questions!

4

Thank you @trettkowski We are assessing the impact from IIQ to ISC migration. we have some powershell in IQService and i am looking for way to use same call as we have in IIQ. Let me know if you find anything useful. let me dig more this week to see if i can find any way.

thanks,
Pravin

5

Hi @pravin_ranjan

You can use afterCreate Rule of SailPoint ISC. I have configured the usecase of enabling the mailbox. Let me know if you need any help.

Thanks
Manish

6

Thanks, Manish. I’m aware of this option, but my goal is to reuse the existing PowerShell script that already resides on the IQService host. I’m expecting there should be a workable approach unless we hit a hard limitation. We currently have a utility that can trigger these PowerShell scripts on demand, so I’m trying to leverage that capability. I’ll also test whether PTA can help here. In the meantime, I’ve asked the SailPoint team to explore possible options.

Thanks,
Pravin

7

You can call the existing script through the AfterCreate Rule of SailPoint ISC but if you want to use this script on ad-hoc basis then you need to use workflows or some custom utility.

8

I currently have a setup like this, where a workflow triggers my PowerShell script to handle email creation in a hybrid event.

In my use case, a user account provisioning event triggers my workflow, which runs some validations and then calls my script.

1 – Workflow
Monitors AD account creation in AD, performs some validations at the workflow level, and then calls my PowerShell script to create the on-prem mailbox.

2 – Workflow
Monitors the identity attribute that indicates whether the user has an email and an Azure account. If so, it triggers my second PowerShell script to apply the cloud policy.

I did this because rules impact provisioning timeouts. During stress tests, I got a few provisioning errors because the rule was taking too long to execute.

With workflows, I managed to bypass those timeouts.

You need a PTA VA and use the Windows Server action in the workflow. And yes, you can leave your scripts on the IQService machine as long as the PTA VA can reach it!

9

Thank you @YanCoelho

If the PowerShell scripts are stored on the IQService machine, what exactly is the execution path? Does the workflow trigger the PTA Windows Server action, which then calls the script on the IQService host?

I’m trying to understand the infrastructure requirements and whether introducing PTA means maintaining an extra Windows server just to run PowerShell automation.

Thanks,
Pravin