Please share any images or screenshots, if relevant.
[Please insert images here, otherwise delete this section]
Please share any other relevant files that may be required (for example, logs).
[Please insert files here, otherwise delete this section]
Share all details about your problem, including any error messages you may have received.
I have a role that gets assigned if the user(s) pass an identity selector rule. For some reason some users are added to the AD group that the bundle applies to and others are not getting added to the AD group.
All the users are getting the entitlement, but not all are making it into the AD group. I am not seeing any errors on the log files. I am not sure why this is happening. Any ideas on how to troubleshoot this?
Side note, I am new to IIQ development. It’s not intuitive. I am also struggling to figure out a way to get all users that have the entitlement applied. That has not been simple.
@cocampbe - Looks like the AD provisioning is failing. Can you confirm if AD test connection works fine and check if there are any provisioning transactions generated?
Can you please check Provisioning Transaction get the more information
Click the Gear Icon in the top right header menu.
Select Administrator Console.
Click on the Provisioning tab (or menu item).
If provisning sucessfull , check in target group already assigned to the users. if yes run the aggregation , also restart the iq service some time response will come from iq service
As suggested by Jagan, check if there any errors in the provisioning transactions and user is assigned to the group in target application. Later run the aggregation task.
To view the users, for whom the entitlement has been assigned, follow the below approach.
Go to Intelligence → Advanced Analytics → Identity
Enter the application, attribute name, entitlement name.
Thanks @Chathuryas . The info you provided about using advanced analytics does not provide what I am looking for. That shows you the members of the AD group. I want to see who has the entitlement, but is not in the AD group.
@cocampbe It looks like those entitlements already have it in their account, that is why it might be filtered out. Before you do an identity refresh, please run the Full AD account aggregation. Check which AD groups are not provisioned that you noticed, and check in AD and SailPoint if the account data is synced. Then, do the identity refresh with the checkbox.
Refresh assigned, detected roles, and promote additional entitlements.
Hi @cocampbe Did you find the solution for this? If Not, Please verify, The Groups are adding in Active Directory but not reflecting in SailPoint or Groups are neither adding in AD nor showing in SailPoint. For First, Do account aggregation and ID refresh with Refresh assigned, detected roles, and promote additional entitlement, Provision assignments. For second, The provisioning issue. Can you update the status.
@cocampbe Please let us know if this issue is still open? In case it is resolved, do share what’s the fix. This’ll help fellow sailors having the similar issue.
As per the provisioning failing for few set of users then validate the identity selector rule.
if possible kindly share the identity selector rule.
since might be failing to detect the required number of users for which the roles should be assigned.
