# Automatic business role ownership updates

**URL:** <https://community.sailpoint.com/discuss/t/automatic-business-role-ownership-updates/30414>\
**Category:** Lifecycle & Governance\
**Tags:** compliance, certifications, identityiq-8.2, access-modeling\
**Created:** [June 6, 2023, 7:11pm UTC](https://community.sailpoint.com/discuss/t/automatic-business-role-ownership-updates/30414 "2023-06-06T19:11:31Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![paulo\_suchoj](https://sea3.discourse-cdn.com/sailpoint2/discuss/user_avatar/community.sailpoint.com/paulo_suchoj/32/16983_2.png) [@paulo\_suchoj](https://community.sailpoint.com/discuss/u/paulo_suchoj)\
**Post date:** [June 6, 2023, 7:11pm UTC](https://community.sailpoint.com/discuss/t/automatic-business-role-ownership-updates/30414/1 "2023-06-06T19:11:31Z")

</div>

I’m currently working with IIQ 8.2p3, and some questions came up during our recent role composition certification.

Does anyone know if it is possible to automate the reassignment of role ownership?

For example, if an owner reassigns his role composition certification to another person, is IIQ capable of initiating an ownership change on said business role with that reassignment as the trigger? It doesn’t matter if through customized code or some native IIQ resource.

I’m adding a simple diagram to illustrate what I mean, hopefully it helps.

 ![2023-06-06_16-08-26.png](https://cdck-file-uploads-global.s3.dualstack.us-west-2.amazonaws.com/sailpointsbx2/original/2X/b/b2693092dfdbfd946aff40f881d32fb606022ea1.png)

---

<div class="post-metadata">

**Author:** ![simehrar](https://avatars.discourse-cdn.com/v4/letter/s/a183cd/32.png) [@simehrar](https://community.sailpoint.com/discuss/u/simehrar)\
**Post date:** [June 9, 2023, 6:38am UTC](https://community.sailpoint.com/discuss/t/automatic-business-role-ownership-updates/30414/2 "2023-06-09T06:38:19Z")

</div>

Hello,

In the “lifecycle” tab of the certification configuration you can set a “End period enter rule” which will be executed at the end of your certification.

From this rule you can iterate on the certification object of you certification, and based on the information in this objects you can change the owner of the role.

When an owner reassign his certification, the certification object is duplicated and the entity inside the original certification object is moved to the cloned one, so if you find a certification object with an entity and a parents, it’s the forwarded one.

I didn’t test it but a rule close to this one should do the job:

\<Source\>  
import org.apache.commons.logging.Log;  
import org.apache.commons.logging.LogFactory;

private static Log log = LogFactory.getLog(“bytel.bidentity.rule.cert”);

log.debug(“entity” + certification.getEntities());  
log.debug(“parents” + certification.getParent());  
if(certification.getEntities() != null @And certification.getParent() != null){  
for(entity : certification.getEntities()){

Bundle role = context.getObjectByName(Bundle.class, entity.getTargetName());

Identity newOwner = context.getObjectByName(Identity.class, certification.getCertifiers());

role.setOwner(newOwner);

context.saveObject(role);  
system.out.println(“set the new owner of role " + entity.getTargetName() +” as " + certification.getCertifiers());  
}  
}

\</Source\>

Best regards,

---

<div class="post-metadata">

**Author:** ![paulo\_suchoj](https://sea3.discourse-cdn.com/sailpoint2/discuss/user_avatar/community.sailpoint.com/paulo_suchoj/32/16983_2.png) [@paulo\_suchoj](https://community.sailpoint.com/discuss/u/paulo_suchoj)\
**Post date:** [June 12, 2023, 8:53pm UTC](https://community.sailpoint.com/discuss/t/automatic-business-role-ownership-updates/30414/3 "2023-06-12T20:53:00Z")

</div>

Thank you very much, this is awesome. I’m getting together with my team and we’ll test this out and iterate on it.