Hi all, I am working on a requirement to remove all the entitlement when a user turns inactive, and the ad account is disabled then all the entitlement of the ad should be removed So, some reason the entitlements are not getting removed. The loop step doesnt fetch the results [1st] Identity trig…

Please use v3 api to patch the source. PATCH https://****.api.identitynow.com/v3/sources/{sourceid} - in body just modify the below content. [ { “op”: “add”, “path”: “/connectorAttributes/cloudServicesIDNSetup”, “value”: { “eventConfigurations”: [ { “eventActions”: [ { “Action”: “ADMoveAc…

And the HTTP details for both are as follows First HTTP CALL : https://TENANT.api.identitynow.com/v3/search Second HTTP CALL: https://TENANT.api.identitynow.com/v3/access-requests

You don’t have to use a workflow. You could use: afterModify rule to catch the DISABLE function to then run a PS script run a scheduled script to remove all entitlements from any users that are disabled. All depends on your coding preference

Hello Soundarya, You may follow the below link which will give you the high level information to your Workflow approach which considers the Workflow limitation, sticky entitlements and AD group default behaviors. [image] Sticky Entitlements ISC Discussion and Questions …

Try using Services Standard IdentityNow BeforeProvisioning Rule which has an action RemoveADEntitlements . This is not deployed to your tenant by default . You can take support help to deploy this rule or you can deploy on your own. Try Something Like this for your usecase : [ { “op”: “add”, …

Hi Bhaskar, can you give me the full steps on how to deploy this in our tenant?

You can try using the built in Get Access and Manage Access workflow actions instead of HTTP actions.

Hi Bhaskar, Which is the api you are using here? is it update-provisioning-policy | SailPoint Developer Community

Hi Soundarya, You need to make sure to have the rule deployed and then you need to patch the source . Thanks, Bhaskar.

Hi Bhaskar, The rule is already deployed in our tenant so let me know which is the patch API you used was it this update-provisioning-policy | SailPoint Developer Community ?

Workflow - Remove entitlements when a identity turns inactive

SailPoint Human Fabric (SHF) SHF Discussion and Questions

suresh4iam (Suresh Kumar Palanisamy) January 28, 2025, 1:51pm 8

Unfortunately I couldn’t provide the JSON since it is implemented in a client tenant and you can refer the link which provides the JSON to built the basic workflow and on top of it you can customize it based on your requirement.

Topic		Replies	Views
When inactive, remove entitlements or access profile SHF Discussion and Questions workflows , identity-security-cloud , entitlements	1	671	December 11, 2023
Workflows failing to remove the entitlements SHF Discussion and Questions identity-security-cloud	11	236	March 19, 2025
Sticky Entitlements SHF Discussion and Questions workflows , identity-security-cloud , access-requests , connectors , entitlements	5	740	December 27, 2024
How to disable an account when the identity status is active but roles have been removed or the validity of a request has ended SHF Discussion and Questions workflows , identity-security-cloud , connectors , entitlements	2	145	March 25, 2025
How to disable an account when the identity status is active but roles have been removed by rule or the validity of a request has ended SHF Discussion and Questions workflows , identity-security-cloud , connectors , entitlements	3	153	March 26, 2025

Workflow - Remove entitlements when a identity turns inactive

Related topics