we are facing challenges to design proper management for onboarded systems where in the Access Profiles there are overlapping entitlements, in the screenshots below is the issue we face upon revocation of an Access Profile.
Figure 1: Example Access Profiles with Overlapping Entitlements
Here the only difference is the Process Owner / Not Restricted entitlement.
Figure 2: User Access
User got both Access Profiles
Figure 3: Now, we are revoking one of them
Figure 4: Then after the revocation both of Access Profiles are removed, the one requested is because of the Access Request or UAR activities, the other because it’s not fulfilling the criteria of the access profile. And the only thing left is the “Process Owner / Not Restricted” entitlement.
Do you have any similar use cases and how you tackle them in order to preserve the Access Profile which not being requested for revocation?
The diagram is attached. For some reason I am not able to paste images within here so I had to upload the whole diagram and create a legend (Figure 1, 2 … etc.) qdocs_overlapping_usecase_sanitized.pdf (106 KB)
In your figure 4, you say that the other AP is removed because the identities no longer meet its (membership) criteria. Membership criteria is an aspect of Roles, but not of Access Profiles. Is it possible your question here is about Roles, or perhaps these APs are part of a Role that these identities also have?
I’d recommend reviewing this section of the docs, concerning AP deprovisioning, to see if there are any insights for your situation.
thanks for your reply. I am talking strictly for Access Profiles only, at this point in the company we are not utilizing roles at all. The current application which we are onboarding will utilize Access Profiles only, and by design from what we’ve tested, ISC removes the second Access Profile because no longer meets the criteria and the only access left is the delta between both Access Profile just as a standalone entitlements. Probably we can design something including the Roles feature but also looking for any possible solutions which are using only Access Profiles.
Can you explain a bit more about what you mean about ‘no longer meeting the criteria’? Is this related to a LCS change causing a revocation of birthright APs?
nope, not related to LCS. It means that if you have two Access Profiles with overlapping entitlements (e.g Entitltlement 1, Entitllement 2, Entitltlement 3) whenever one of the Access Profiles is revoked (no matter Request Center, UAR or any other configuration) after ISC re-evaluates the identity access it will remove the second access profile because the managed entitlements are removed with the revocation of the first Access Profile.
I am looking of a way to avoid this from happening so we can have Access Profiles with overlapping entitlements.
Thanks for all of your clarifications. I was able to reproduce the behavior you described in my tenant, but need to do a bit more research. I’ll update you again soon.
Again, thank you for all of the clarifications to help me understand your scenario. The behavior you’re describing is in fact expected and documented here. For your convenience, I’m pasting the relevant part here:
The following are the limitations and behavior of access profile deprovisioning:
…
Overlapping entitlements between access profiles are revoked.
When a user has two access profiles (not through roles) with overlapping entitlements, revoking one of those access profiles removes all of its entitlements.
The user will lose the second access profile because they do not have its required entitlements. However, any other entitlements granted to the user by the second access profile are retained as individual entitlements.
This is true whether the access profile was detected for the user or granted to them through provisioning processes.
In summary, I don’t think there is anyway to avoid this behavior and unless you leverage roles as well as APs.