We have a use case where an app owner is requesting we trigger an email notification to them when a user gets removed from an access profile (the profile is provisioned into AD but the access also requires work in a non-connected system as well). This is the first time we are looking at something new instead of updating an existing object so I any help pointing me to documentation or suggestions are appreciated.
Hello nathanwray, I’m not aware of that capability existing in IdentityNow, but if anyone else is - please chime in!
In case you haven’t already seen it, a similar idea at the SailPoint Ideas Portal is currently marked for future consideration. Feel free to add to the comments, or propose a different idea if that one wouldn’t meet your needs.
I have some thoughts in different directions, but without knowing more about the current config, it’s hard to promote one over the other. Maybe something here triggers a solution that will work for you?:
Option 1:
Do the users get the access profile via a specific lifecycle state (i.e. provisioning tab of identity profiles)? If so, that’s an easy way for people to get notified when the AP gets deprovisioned along with the LCS change - there is an email notification section at the bottom of the page where you can define who receives the notification.
Option2:
If not the above situation, then workflows is a great option, and possibly the best. There is a “Provisioning Completed” trigger. You can create a filter for specific changes, get the list of identities who changed, a specific source account and identity access and send an email notification to whomever or manage a servicenow ticket.
Option 3:
If you don’t have workflows, then you can leverage just the “Event Triggers” feature. Using the same “Provisioning completed” event trigger, build a subscription that sends a JSON payload to a system like your mail system. Event triggers either use http (or https://) for communicating the message or Amazon Event Bridge.
Option 4: Saved Search With Email Subscription
You can create a search around provisioning activity, specific to your AD group or access profile. If you know that certain attributes are different before and after the provisioning activity, you can leverage that info in your query. Again, without specifics about the attributes, source names, AP names, etc., it would challenging to promote a specific search query to fit your needs. I would specifically look at Events (start with type:provisioning) and Account Activity. There are a lot of options (see below). Once you have a search query established, you can SAVE it then SUBSCRIBE to it - for yourself and other admins who need to know. While this is not the same as “real time” notification of changes of workflows and event triggers, you could run the saved search Daily (at multiple times per day. One of the options in a saved search subscription is to “Send the report even when no items match the query”. With that toggled OFF, you only get the email when results are found: