What I am trying to accomplish is for a workflow to send a notification to someone when access has been granted to certain roles, access profiles, or entitlements. I have created metadata tags that indicate who should be notified. I have chosen the “Provisioning Completed” trigger to kick off the …

Hi @BCyr , Please note that within the “Provisioning Completed” trigger, you do not have direct access to roles or access profiles that have been granted. Instead, you can only access the provisioning plan, which contains information about sources, entitlements to add or remove in target systems, an…

Hi Chaithanya, Where in the workflow we can write the code ? Could you please help ? ? Thanks Rakesh Bhati

The workflow is triggered by a post-provisioning event. It starts with a “Process Provisioning” step that iterates through account requests, specifically looking for “Add” operations on the “memberOf” attribute. For each iteration: a. It retrieves access details using the “Get Access Details” actio…

I understand what you are saying, and my workflow already gets this far, but in your example, access was granted to a single AD group. My issue is that when there is more than one AD group assigned to the role, the value in “attributeValue”: “CN=admin,DC=training,DC=com” is a comma separated li…

Hi @BCyr Thank you for the questions. May be I overlooked something but if you are able to get the roles, then perhaps instead of iterating through the event input, you can call below API via role get-role-entitlements | SailPoint Developer Community <Heading …

@BCyr understood now the issue. Do you want to sent an email per entitlement ? you can use comparison operators.

I am intrigued. Can you elaborate?

Agreed, but it cannot confirm for me if adding the user to the entitlement was successful. I mean, the odds of adding a user to one AD group and not another would be pretty slim, so I could …dare I say it?.. “assume” that it all worked. :slight_smile:

Hi @BCyr Yeah you are right. But i believe if you gather the provisioning status from the trigger, then it should be fine i believe and if one entitlement was added successfully and other was not (lets assume) then during next aggregation ISC should automatically push it back to AD so should work. …

Workflow Assistance - Sending emails after access is granted

Identity Security Cloud (ISC) ISC Discussion and Questions

Chaithu9110 (CHAITHANYA M) June 3, 2025, 5:29am 8

Topic		Replies	Views
Workflow - how to detect Access Profile added to identity via role ISC Discussion and Questions workflows , identity-security-cloud	3	258	February 15, 2025
Email Notification after Entitlement Removal via Workflow ISC Discussion and Questions workflows , identity-security-cloud , entitlements	18	697	October 25, 2024
Filter for Provisioning Completed trigger workflow ISC Discussion and Questions webservice-connector , workflows , identity-security-cloud	12	416	January 25, 2025
Fetch Entitlement name From Provisioning Completed Trigger ISC Discussion and Questions workflows , identity-security-cloud , access-requests	9	222	October 5, 2024
Sending email to outside team for further access provisioning IIQ Discussion and Questions email-templates , identityiq , provisioning	13	171	September 19, 2025

Workflow Assistance - Sending emails after access is granted

Related topics