Hi everyone,
This workflow auto-revokes any standing access leavers have either through a micro targeted access certifications or by leveraging revoke access requests after being terminated. This should ensure that all leavers’ access is removed upon terminated and not just access assigned through birthright roles. Additionally, an audit trail is generated to document when and why the access was removed.
This workflow was designed and built with the help and input of a multiple people! Thanks to everyone involved
Workflow Design
High-level design?
Simple Implementation
This solution uses a single workflow triggered by the Identity Attribute Change
event.
Advanced Implementation
This solution uses two (optionally three) workflows - the master, an optional scheduled, and two options of child workflows depending on your requirements.
- The Master workflow’s trigger is
Identity Attribute Change
. It calls the child workflow once. - [Optional] The Scheduled workflow’s trigger is
Scheduled Trigger
. It calls the child workflow in a loop. - The child workflows’ trigger is
External Trigger
(as it is being called by the Master and Scheduled workflows).
1. The Master Workflow
The master workflow is triggered off of changes of the cloudLifecycleState
attribute also ensuring the newValue
is inactive
. This can be different per environment according to when you want to remove all standing access of leavers.
2. The Child Workflow Options
Option 1: Access Certification Child Workflow
This child workflow only gets the id of the leaver identity. The child workflow creates a micro targeted certification campaign specifically for the leaver. Be default, we are assigning the campaign to the leaver’s manager, however all notifications and recommendations are disabled. Then it automatically completes the campaign and revoke all access.
Option 2: Access Request Child Workflow
This child workflow also only gets the id of the leaver identity. The child workflow uses the Search API to find access items that can be revoked such as standalone entitlements and revocable Access Profiles and Roles (i.e. non-birthright access). It then uses the default Manage Access
step to submit access requests to revoke such access.
[Optional] 3. The Scheduled Workflow
Optionally, you can use this workflow to perform a cleanup of all standing access for your existing leavers. The scheduled workflow is scheduled to run every 12 hours, however this can be tweaked as required. The Search API is utilized to find all leavers that have standing access that should be revoked.
Considerations
Please make sure you properly test the workflows in your sandbox environments before introducing any changes to your production environments
Which child workflow should I use?
The recommended approach is using Option 1: Access Certification Child Workflow for the following reasons:
- Simple and clean approach to remove ALL access
- Concise audit record of all leaver access being removed in one area (the leaver campaign)
- No scalability or perfomance concerns
You may want to use Option 2: Access Request Child Workflow for the following reasons:
- The need to filter on specific access that should be removed
- Leaverging the configured revoke access approvals in your leaver process
Please note that using the Option 2: Access Request Child Workflow introduces some limits to the process with looping, which may result in an incomplete removal of access on the initial go. It might be a good idea to use the Scheduled Workflow in addition to the Option 2: Access Request Child Workflow to ensure ALL access is removed in the later iterations.
Usage Instructions
Please make sure you properly test the workflows in your sandbox environments before introducing any changes to your production environments
-
Download the three required Workflow JSON scripts (see below).
-
Create a Personal Access Token (PAT) to get a client ID/secret pair needed for the API calls. You must add the
sp:scopes:all
scope to your PAT. -
Upload the Simple workflow JSON (if using the simple implementation) or the Child workflow of choice JSON first into your Identity Security Cloud tenant.
-
Edit the Workflow in the Workflow Builder, substituting: your OAuth Client ID, OAuth Client Secret, OAuth Token URL and Request URL with the PAT details and the correct tenant name for the followin steps depending on your choice of child workflow
- Simple / Access Certification Child workflow steps:
Update Campaign Deadline
Autocomplete Leaver Campaign
- Access Request Child workflow steps:
Get Standalone Entitlements
Get Revocable Access
Next steps are only required if using the Advanced Implementation
- Generate a new access token from the child workflow’s external trigger to avoid problems where the master/scheduled workflows and preferred child workflow are not in sync.
- In the preferred child workflow, edit the
External Trigger
step - Press [+New Access Token]. This generates a new Client URL, Client ID and Client Secret.
- Write them down somewhere as you will need them in the upcoming steps
-
Upload the Master workflow JSON into your Identity Security Cloud tenant.
-
Edit the Master Workflow in the Workflow Builder, substituting: your OAuth Client ID, OAuth Client Secret, OAuth Token URL and Request URL with the External Trigger details genetated from the Child workflow for the
Remove Standing Access
step. -
[Optional] Upload the Scheduled workflow JSON into your Identity Security Cloud tenant.
-
Edit the Scheduled Workflow in the Workflow Builder, edit the
Scheduled Trigger
step, changing the frequency to whatever is requrired. -
Edit the
Find Leavers with Access
step substituting: your OAuth Client ID, OAuth Client Secret, OAuth Token URL and Request URL with the PAT details and the correct tenant name. -
Edit the
Remove Leaver Access
step, substituting: your OAuth Client ID, OAuth Client Secret, OAuth Token URL and Request URL with the External Trigger details genetated from the Child workflow.
Workflow Definitions
Simple Leaver Workflow
Leaver - Simple - Remove All Access - fix.json (5.0 KB)
Advanced Leaver Workflows
Leaver - Master - RemoveStandingAccess.json (1.5 KB)
Leaver - Scheduled - RemoveStandingAccess.json (3.1 KB)
Leaver - ChildAccessCertifications - RemoveStandingAccess.json (4.7 KB)
Leaver - ChildAccessRequests - RemoveStandingAccess.json (4.3 KB)