ISC : Entitlement Owner Review in Sailpoint IdentityNow

Lifecycle & Governance
, ,
1

Hi,

Trying to create a certification campaign for Entitlement Review with Entitlement Owner as reviewer. Is there a way we can make Entitlement Owner as reviewer of certificate in IdentityNow?

Thanks,

Ankita.

2

@AnkitaTanwar , not at the moment - but please see this: https://ideas.sailpoint.com/ideas/GOV-I-3566  (spoiler alert: Current status is In Discovery)

You can also check out this discussion: Is there a way to setup Campaign based on Entitlement Owner - SHF Discussion and Questions - SailPoint Developer Community

3

Not in a direct way.

  1. Select entitlements and select a dummy identity as certifier.
  2. Write a program (java, powershell, python) etc..to make Sailpoint REST API calls
  3. Get the list of entitlements and their owner identity.
  4. Re-assign each item : https://developer.sailpoint.com/docs/api/v2025/move
4

HI  @AnkitaTanwar  There is at least 1 way to achieve this at the moment:

  1. Create a Search-based Access Item campaign - select all the entitlements required
  2. Make all reviews go to {anyone }- I think it’s easiest if all reviews are set to 1 individual.
  3. Generate and Start the campaign
  4. Write a script using the API to reassign items to the Entitlement Owner.

It is not the prettiest solution, but it is one I have seen customers use in the field.

Possible APIs to use:
https://developer.sailpoint.com/docs/api/v2025/reassign-identity-certifications
https://developer.sailpoint.com/docs/api/v2025/move
https://developer.sailpoint.com/docs/api/v2025/submit-reassign-certs-async

5

We want to actually turn off reassign for Managers who perform the review.Is there an approval process we can introduce to approve the reassignment process by Cert Admin?

6

Also you can exlpore Bulk Certification Tool, this might need more efforts on the initial setup but would get easier/quicker in long run if there aren’t too many changes on the entitlement grouping. Though one drawback worth considering is you’ll end up with multiple campigns instead of a single one, as you would get with above approach.

Best,
Vikram