# What workflow is getting triggered while revoking the access-review during the certification **URL:** \ **Category:** IIQ Discussion and Questions\ **Tags:** identityiq\ **Created:** [November 2, 2023, 7:55pm UTC](https://developer.sailpoint.com/discuss/t/what-workflow-is-getting-triggered-while-revoking-the-access-review-during-the-certification/20168 "2023-11-02T19:55:38Z")\ **Posts on this page:** 12\ **Page:** 1
**Author:** ![didudeb2006](https://avatars.discourse-cdn.com/v4/letter/d/cab0a1/32.png) [@didudeb2006](https://developer.sailpoint.com/discuss/u/didudeb2006)\ **Post date:** [November 2, 2023, 7:55pm UTC](https://developer.sailpoint.com/discuss/t/what-workflow-is-getting-triggered-while-revoking-the-access-review-during-the-certification/20168/1 "2023-11-02T19:55:38Z")
What workflow is getting triggered while revoking the access-review during the certification ? Step1: Created a manager Certificate. Step2: Revoked all account access review and Signed Off Step3: Ran the Perform maintenance task. Step4: Certificate has been completed. From few documents, I got to know that this process is triggering LCM provisioning. So, have created another Workflow copied from LCM provisioning configuring that in Life Cycle Manager but I found this process is not at-all getting triggered. ![image](https://global.discourse-cdn.com/sailpoint/original/2X/8/8e2939495c298a3c908fcbd5290f4839763a1fb2.png) ---
**Author:** ![anon99270358](https://avatars.discourse-cdn.com/v4/letter/a/ee7513/32.png) [@anon99270358](https://developer.sailpoint.com/discuss/u/anon99270358)\ **Post date:** [November 3, 2023, 2:52pm UTC](https://developer.sailpoint.com/discuss/t/what-workflow-is-getting-triggered-while-revoking-the-access-review-during-the-certification/20168/2 "2023-11-03T14:52:58Z")
When revoking access in an IIQ certification a ProvisioningPlan will be created and associated with the CertificationItem which is part of a Certification XML object. When PM task runs, it will check for any ProvisioningPlans associated with a CertificationItem and kick off provisioning during that time. A specific workflow is not executed during this process. You can always enable sailpoint.WorkflowTrace in log4j to determine what workflows are being call during processing. ---
**Author:** ![didudeb2006](https://avatars.discourse-cdn.com/v4/letter/d/cab0a1/32.png) [@didudeb2006](https://developer.sailpoint.com/discuss/u/didudeb2006)\ **Post date:** [November 3, 2023, 6:23pm UTC](https://developer.sailpoint.com/discuss/t/what-workflow-is-getting-triggered-while-revoking-the-access-review-during-the-certification/20168/3 "2023-11-03T18:23:32Z")
Does PM task triggers any Rules or Workflow? I found the below piece of code from “Rules in identityIQ” document. Could you please advise, where to add this code to redirect the flow to a new Group. ![image](https://global.discourse-cdn.com/sailpoint/original/2X/c/c7f39df89f54849b9847c111dd1eec5aa5d9f79e.png) ---
**Author:** ![venus](https://avatars.discourse-cdn.com/v4/letter/v/35a633/32.png) [@venus](https://developer.sailpoint.com/discuss/u/venus)\ **Post date:** [November 3, 2023, 7:14pm UTC](https://developer.sailpoint.com/discuss/t/what-workflow-is-getting-triggered-while-revoking-the-access-review-during-the-certification/20168/4 "2023-11-03T19:14:29Z")
Certification revocation create a Modify action with remove entitlement. One option is before provisioning rule, where you can add your custom logic. ---
**Author:** ![didudeb2006](https://avatars.discourse-cdn.com/v4/letter/d/cab0a1/32.png) [@didudeb2006](https://developer.sailpoint.com/discuss/u/didudeb2006)\ **Post date:** [November 3, 2023, 7:36pm UTC](https://developer.sailpoint.com/discuss/t/what-workflow-is-getting-triggered-while-revoking-the-access-review-during-the-certification/20168/5 "2023-11-03T19:36:02Z")
> [@venus](#): > > where you can add your custom logic Could you elaborate , which rule I need to look into and add my custom code ? ---
**Author:** ![KRM7](https://sea1.discourse-cdn.com/sailpoint/discuss/user_avatar/developer.sailpoint.com/krm7/32/2685_2.png) [@KRM7](https://developer.sailpoint.com/discuss/u/KRM7)\ **Post date:** [November 3, 2023, 7:54pm UTC](https://developer.sailpoint.com/discuss/t/what-workflow-is-getting-triggered-while-revoking-the-access-review-during-the-certification/20168/6 "2023-11-03T19:54:29Z")
I haven’t asked this question in last couple of years. but I guess it is LCM Provisioning only. When a Provisioning Plan is created, it has an argument **source** , which defines from where this plan is generated. If you place a request in **Manage Access** then source will be **LCM** When you try to synchronize the attributes to target apps using Target Mapping, source will be **IdentityRefresh.** Similarly in certification, if it is Approve then nothing to do, access will stay back. If it is deny then a revocation plan will be generated with source as **Certification**. Every plan before it gets executed (OOTB), it has to go through Before Provisioning Rule. I believe you need to do some customization to process the certification revocations, so add that custom logic in your Before Provisioning Rule with below code. ```auto String source = plan.getSource(); if (source.equalsIgnoreCase("Certification")) { /* Custom logic */ } ``` ---
**Author:** ![Remold](https://sea1.discourse-cdn.com/sailpoint/discuss/user_avatar/developer.sailpoint.com/remold/32/3275_2.png) [@Remold](https://developer.sailpoint.com/discuss/u/Remold)\ **Post date:** [November 3, 2023, 7:59pm UTC](https://developer.sailpoint.com/discuss/t/what-workflow-is-getting-triggered-while-revoking-the-access-review-during-the-certification/20168/7 "2023-11-03T19:59:22Z")
A BeforeProvisioning rule is configured per application. ![image](https://global.discourse-cdn.com/sailpoint/original/2X/8/8687541b4be8da657ec03e067ef6992575d2947b.png) For an example of a BeforeProvisioning rule, see the ‘[Rules in IdentityIQ](https://community.sailpoint.com/t5/Technical-White-Papers/Rules-in-IdentityIQ/ta-p/78176)’ Technical White Paper – Remold ---
**Author:** ![didudeb2006](https://avatars.discourse-cdn.com/v4/letter/d/cab0a1/32.png) [@didudeb2006](https://developer.sailpoint.com/discuss/u/didudeb2006)\ **Post date:** [November 6, 2023, 8:25pm UTC](https://developer.sailpoint.com/discuss/t/what-workflow-is-getting-triggered-while-revoking-the-access-review-during-the-certification/20168/8 "2023-11-06T20:25:12Z")
As per my requirement I have to create an Identity Certification. The steps I have followed to Call Before Provisioning Rule is as below. **Step1** : Selected an identity and checked the account it’s belonging to. **Step2** : Assigned the Before Provisioning Rule to the Application(For the same Account) **Step3** : Created the Identity certification for that Identity and revoked the all access review and Signed Off. **Step4** : Ran Perform Maintenance Task. I can see, the certification has been completed successfully but the Before Provisioning Rule has been called at all. Any advise ? ---
**Author:** ![Remold](https://sea1.discourse-cdn.com/sailpoint/discuss/user_avatar/developer.sailpoint.com/remold/32/3275_2.png) [@Remold](https://developer.sailpoint.com/discuss/u/Remold)\ **Post date:** [November 6, 2023, 9:18pm UTC](https://developer.sailpoint.com/discuss/t/what-workflow-is-getting-triggered-while-revoking-the-access-review-during-the-certification/20168/9 "2023-11-06T21:18:37Z")
Can you take a step back and tell what your high level requirement is? Why do you need to change anything regarding the revocations? It might be a good idea to take a look at the Technical White Paper [Lifecycle of a Certification](https://community.sailpoint.com/t5/Technical-White-Papers/Lifecycle-of-a-Certification/ta-p/76216). Regarding the found ‘ApprovalAssignment’ rule, this rule is not related to Certifications (aka Access Reviews). The Approval flow is (by default) only used for Access Requests. – Remold ---
**Author:** ![didudeb2006](https://avatars.discourse-cdn.com/v4/letter/d/cab0a1/32.png) [@didudeb2006](https://developer.sailpoint.com/discuss/u/didudeb2006)\ **Post date:** [November 7, 2023, 3:37pm UTC](https://developer.sailpoint.com/discuss/t/what-workflow-is-getting-triggered-while-revoking-the-access-review-during-the-certification/20168/10 "2023-11-07T15:37:30Z")
Thanks Remold. Here is my requirement. I need to create an Identity certificate and during Access Review, when the Certifier revokes the access, the Workflow should redirect to a particular User group. Any advise how to implement it ,and which Rule or Workflow I need to make the change ? ---
**Author:** ![aishwaryagoswami](https://sea1.discourse-cdn.com/sailpoint/discuss/user_avatar/developer.sailpoint.com/aishwaryagoswami/32/4357_2.png) [@aishwaryagoswami](https://developer.sailpoint.com/discuss/u/aishwaryagoswami)\ **Post date:** [November 8, 2023, 7:07pm UTC](https://developer.sailpoint.com/discuss/t/what-workflow-is-getting-triggered-while-revoking-the-access-review-during-the-certification/20168/11 "2023-11-08T19:07:22Z")
Hello Debasis, Regarding the line - “the Workflow should redirect to a particular User group” Can you elaborate on what you want the workflow to direct? Are you saying that the access review should be redirected to a workgroup? I think if you want to add some logic for revocation, as Krishna suggested you can add a before provisioning rule. As for it not getting triggered, you might want to let us know what logic you have written. Also, i think it would be best if you close this thread and make a new one because the original question [What workflow is getting triggered while revoking the access-review during the certification] has been answered and the new thread will also give the experts more clarity on your requirement as well 🙂 ---
**Author:** ![system](https://global.discourse-cdn.com/sailpoint/original/2X/f/f2136700ed5e3703e0b85e02f6be799dacca7735.png) [@system](https://developer.sailpoint.com/discuss/u/system)\ **Post date:** [January 7, 2024, 7:08pm UTC](https://developer.sailpoint.com/discuss/t/what-workflow-is-getting-triggered-while-revoking-the-access-review-during-the-certification/20168/12 "2024-01-07T19:08:01Z")
This topic was automatically closed 60 days after the last reply. New replies are no longer allowed.