For unwanted entitlement schemas, We want to rest entitlements for a source after unwanted entitlement schema is deleted. what can be the impact on access of already using entitlements of that source. do we need to do this in non-working hours? kindly suggest on this.
Hi @shaffusailpoint your identities will get again these entitlements after aggregation (it does not trigger entitlement removal on target systems). But you will have to reconfigure access profiles and roles which holded reseted entitlements. I think it can be done on working hours but… being a production environment, all cares are welcome.
thanks Sosa. Does it mean all access profiles and roles holding entitlements will be lost, again need to map?
Hello @shaffusailpoint,
Yes, once you have aggregated back all of the entitlements, you will need to map all of the access profiles and roles again that included entitlements previously.
hi @shaffusailpoint,
If you have a campaign running you might have to consider that as well.
If the entitlements are removed and if anyone revokes the access then ISC will not find the access to be removed on that particular source. Same goes with Access Request.
Thanks,
Uday
Hello @shaffusailpoint
Resetting Entitlements/Accounts, always remember, ISC will consider them a new entry. When I say new entry which means their unique ID’s which ISC assigns them will be updates.
So, wherever you have used the old entitlements, i.e. in criterias or any role or any AP configuration will need to be re-traversed.
Also, if accounts on that source has those entitlements, then you need to disable account aggregation on that source, because even if you disabled entitlement aggregation but before you could finish any modifications on source end, account aggregation will bring those entitlements in ISC, which can be concerning for you.
We advise resets to be done outside of business hours to give you buffer handling any unwanted changes.
This topic was automatically closed 60 days after the last reply. New replies are no longer allowed.