Workarround removal of access rights (restriction of items in Workflow)

[fabienne_florian]

Hi all,

I saw the forum discussion regarding the limitation of getting accounts (250 is the limit) and putting them it into a loop (100 is the limit) and I was trying to reuse it in regards of entitlements (list-entitlements | SailPoint Developer Community). I would like to remove all entitlements of an identity, but some identities have more than 100 entitlements. I need a loop to remove one by one. So, I thought of using a couple HTTP requests with an offset and limit so that I get a list with max. 100 items to put it into a loop afterwards for removal via Manage Access. But I’m not sure what is meant with “account-id” as it was not working for me. I looked up my own account id for my Azure AD account and I put it in postman, but it didn’t work. So, I thought I have a misunderstanding in regards of what is meant with “account-id”.

Or is there another way how I can reach my goal?

Thank you a lot in advance.

[suresh4iam (Suresh Kumar Palanisamy)]

It is very difficult to give you the details about error without looking at Workflow JSON definition. Can you share your Workflow JSON to check the issue?

You can also look at the Workflow to remove ALL leavers’ standing access for other options by using Workflow.

[Santhakumar (Shantha Kumar)]

The account-id is the id for each specific source accounts you can get this in the get accounts operator, but instead you can use the source ID to remove the entitlements from the selected source.

If possible give me a snapshot or JSON file of the WF to look into more.

Thanks.

[fabienne_florian]

Hi the idea with the certification for removing all access rights is interessting, but how do they do the auto. complete? Is it an HTTP request which is calling an API for that? I guess this one complete-campaign | SailPoint Developer Community, right?

I first tried it just with postman, where I just entered the following data:

I also tried to put the value of “account-id” into “”, but this didn’t help either. So if it is not working in Postman, then it will probably also not work in the workflow. Offset and limit is working, but not the account-id. For the account-id I took the id of my Azure AD account (identity → then on accounts and copied from the column id of my azure AD account).

So, here I thought I would get then all entitlements that belong to my Azure AD account and in the workflow later for the respective user. I just designed the idea of the workflow, but this is not working yet, but if it helps I can provide the current draft.

Thanks for the help

[suresh4iam (Suresh Kumar Palanisamy)]

You can check my another post on how I did it by using Cert Campaign and auto complete it.

Sticky Entitlements

You can use Before Provisioning Rule to loop through all the assigned entitlements and remove it which could be a custom written code. Since you are using Workflow, you can handle it in Workflow itself by using Certification Campaign. I have implemented the same scenario using Workflow as below. Solution Summary: Trigger the workflow when identity’s LCS changed to inactive. Get the identity details by using Get Identity action. Create a search-based certification campaign to remove all the s…