Our company is in the process of migrating to a RBAC model. This has drawn the attention of our auditors and regulators, rightly so, because it moves the bulk of the control from regular access item campaign to role composition campaigns (this is not my issue, this is by design and it’s good). In this process our auditors made the observation that it’s possible to include access profiles in role compositions, but the role composition campaign doesn’t review the composition of those access profiles, only the composition of the role itself is reviewed. This presents a concern because theoretically someone could change the composition of a role without it being detected by changing the composition of the access profile.
This seems like a fairly obvious shortcoming, so I find it hard to believe this isn’t by design, and if it is by design then what’s the recommended approach to close the gap?
Hi @pillar224 Keeping auditors happy is important! Access profile composition certification has been proposed as an Idea in our Ideas portal, is under consideration as a future feature, and I have actually voted on it before: https://ideas.sailpoint.com/ideas/GOV-I-1947
When I review Roles, I can see access profiles and drill into them to see which entitlements are included in those access profiles. I can review all entitlements contained within the role, whether they are directly included or part of the access profile, then either approve or revoke the access profile from the role (but not the entitlements included within it).
Is your organization’s experience different? I’m trying to determine what additional functionality might satisfy the auditors’ requirements. Any other details you might be able to provide by chance?
If the primary objective is a report of access profiles with their included entitlements, you could use the Access Profiles API to generate a list of access profiles. Obviously this is not a certification but it gets you the granular data.
From the role composition certification, there’s not a way to revoke specific entitlements from access profiles, just the whole/individual access profile(s).
Thanks for your response. I agree with you, when reviewers are reviewing the role composition, they can see the access profiles that make up the role, and they can even see the composition of the access profile, but they can’t actually change the composition of the access profile. They can either approve the entire access profile (and all of its entitlements) or revoke the entire access profile.
For now, the role composition campaign is what we have. Hopefully you were able to vote on the idea. I will pass along feedback to the Product team that this is still a requested feature.
I can see how to achieve this experience with the access profile APIs and perhaps an interactive workflow or custom UI, if one wished to go that route.
