We have access for individuals tracked on a role assignment. Working through a clean up project for each role and access. When we remove a system from the role there is not a work item created. The work item created triggers a notification for teams to review access based on the type.
We have the ability to revoke to create a work item but this is more work for roles that have multiple users assigned.
Adding additional systems creates work items as expected.
Hello @sgalbraith , when you say “remove a system from the role” it sounds like you are referring to removing an access profile or entitlement from the role? If so, by default, identities will keep the access (entitlements) the role has assigned.
To initiate deprovisioning of the access (entitlements) assigned by the role, you’ll need to change the role matching criteria so the identities no longer meet the role criteria and will no longer have the role assigned. That will initiate deprovisioning of the access associated with that role - unless they hold that access somewhere else, such as through a different role, access profile, or directly assigned entitlement.
Recently however, there was an enhancement to Identity Security Cloud called “Role Change Propagation” which, if enabled, willremove access when a role’s composition changes. For example, if Role Change Propagation is enabled and an access profile or entitlements are removed from a role, the access will be removed from identities assigned to that role. Role change propagation is explained more fully here.
Please let me know if that makes sense and helps answer your question!
Thanks for your response! Correct we are using roles to assign entitlements. We did try to create a new role with only the entitlements we needed but no work items were created for remove. (Screenshot attached) We did disable the first role after the second applied could that have been the issue is the system didn’t remove it correctly? In that case would you recommend modifying the define assignment to allow the system to remove before disabling and deleting the old role?
It also looks like the link for role change propagation is pointed to attribute sync but was able to search and looks like that may be the best route when its enabled.
@sgalbraith yw & apologies - looks like I spoke too soon, as the capability to propagate role changes won’t be rolled out to production tenants for a few more weeks (late July, 2025). You can read about it here in this announcement.
Yes, if you want a role’s access items (entitlements) removed from the identities with that role, you have to change the role assignment criteria so the identities no longer match it. Then the access will be deprovisioned. But if the identities still hold the access some other way, such as belonging to another role, the access will not be deprovisioned.
Modifying other parts of the role configuration, like removing its access profiles and entitlements, and even deleting the role, will not remove the entitlements from the identities that have the role assigned. So you have to change the role assignment criteria, then when the identities no longer match they will be deprovisioned that access.
When role change propagation is ehabled, you’ll have the abilitiy to enable it so that changing the role parameters willcause identities to be deprovisioned the access. But that won’t be available uintil July 2025.
Does that make sense? If not, please let me know!
That makes total sense! Just retested on the disabled role reenabling it and changing the define assignment to remove and it created the work items I needed.
Thank you for all the information!
