UAT sandbox - inconsistencies in access behavior with role assignments

Identity Security Cloud (ISC) ISC Discussion and Questions
,
1

A customer is in UAT currently and when processing a new account through they didn’t receive the access they should have had. I noticed that the lifecycle state they were in was not applicable to the roles they should be getting access to. I am not aware of any changes to the role. Prior accounts that were in the same lifecycle had access.

I modified the roles for the missing lifecycle and all looks to be well, except the search on users matching the same criteria for the role are not showing the update on the entitlement count, role count, etc. Is the search data delayed in being populated?

How do I look to see when the role was last modified? It doesn’t seem to update when I just modified the role, the modification date that is.

What is the recommendation to be able to best audit these events or find when the role was modified in the last 60+ days?

Note that the image should be showing the prehire account as not having any roles or enough entitlements. I’m also concerned that the last user lsited is showing 6 entitlements rather than 8. Is there an easy way to do a side by side comparison of access for two users?

How do I see what changes IDN deployed to the tenants in the last 30 days, to rule out any possible code changes?

image
image1166×715 9.34 KB

2

Hi @ts_fpatterson - for checking modifications to a role, you can use the V3 Get Roles API and look at the modified attribute.

If you’d like to see any roles modified in the last 60 days, you can use a search query that you can subscribe to like modified:[now-60d TO now]

For checking user data, try to use Account Activity via search (using REST APIs) for the two users you want to compare, and look at the query responses.