Managing AD entitlements in SailPoint IDN

Lifecycle & Governance
, ,
1

Hello,

We have a requirement to manage Access request for the existing AD group with members already provisioned to those AD groups. Currently we are just Aggregating those entitlements to our SailPoint IDN and we can see the users who have access to those entitlements in AD.

Could you please help us with the approach to manage the existing user’s access for example revoking access for already provisioned users in AD and new members provisioning to those AD groups without migrating manually to SailPoint IDN Roles/Access Profile?

Regards,

Ananthi V

2

The AD groups (entitlements) can be marked as “requestable” so that end users can raise an Access Request for them. To remove existing AD groups from users, currently managers can request the removal of access for their direct reports, or an Org Admin can request the removal for any other identity.

See:

Configuring Access Requests for Entitlements - SailPoint Identity Services