Announcing the Saviynt Knowledge Exchange unifying the Saviynt forums, documentation, training,
and more in a single search tool across platforms. Read the announcement here.

How to automatically assign an AD group when requesting for an application account

Thriller
New Contributor III
New Contributor III

How to automatically assign an AD group when someone requests for an application account?
I thought of adding the AD group under 'Entitlements with New Account' but if I add it that way the AD group would be assigned also via Birthright. The requirement is to assign it only when someone requests for an application account

Please let me know. Thank you

10 REPLIES 10

rushikeshvartak
All-Star
All-Star

You can add default entitlement under Entitlement Map.

rushikeshvartak_0-1716526339942.png

 


Regards,
Rushikesh Vartak
If you find this response useful, kindly consider selecting 'Accept As Solution' and clicking on the 'Kudos' button.

Hi @rushikeshvartak,

I need to assign an AD group when someone requests for an application let's say Hyperion. How can I do it?

Thriller
New Contributor III
New Contributor III

Any idea on how I can implement this use case? Can I do it via Analytics (Provision Access) if the arstasks.source = 'REQUEST'? If yes, what are the things I need to pass to Provision Access via Analytics. Can you guys please give me a sample
Basically, I need to assign certain AD Group to the user if they request for an application (example: Hyperion) account. I don't want to put the AD Group under 'Entitlements with New Accounts' because that way AD group would be assigned also via Birthright

@Thriller  you can create Actional report based endpoint, if any account request have in pending list then trigger analytic create task like

https://forums.saviynt.com/t5/identity-governance/add-access-actionable-analytics/m-p/66629

Refrence sample query we done some application enable condition based we created add access task :

select distinct a.accountkey AS 'acctKey', '496220' AS 'entvaluekey', a.accountid, a.comments as "Addl Info", u.userkey as 'userKey', u.username AS USER, a.name as accName, u.FIRSTNAME, u.LASTNAME, u.EMAIL AS USER_EMAIL, SYSDATE() AS RUNTIME, 'provisionaccess' as 'Default_Action_For_Analytics', a.endpointkey from users u, user_accounts ua, accounts a, account_entitlements1 ae where a.status in ('ACTIVE','Manually Provisioned','1') and u.userkey = ua.userkey and ua.accountkey = a.accountkey and a.accountkey=ae.accountkey and a.endpointkey in (select endpointkey from endpoints where endpointname ='ISC AD') and u.userkey in (select userkey from arstasks where endpoint in (select endpointkey from endpoints where endpointname ='ORBXXX') AND TASKTYPE = 6 AND STATUS in ('1'));

 

 


Thanks,
Raghu
If this reply answered your question, Please Accept As Solution and hit Kudos.

Thriller
New Contributor III
New Contributor III

Hello,
I added in below code and I was able to generate an 'Add Access' task for AD

select distinct u.username, a.accountkey as acctKey, 'Provision Access' as Default_Action_For_Analytics, a.name as accName, u.userkey as userKey, 171674 as entvaluekey from users u, user_accounts ua, accounts a, arstasks ar where u.userkey = ua.userkey and ua.accountkey = a.accountkey and a.ARSTASKKEY = ar.TASKKEY and a.endpointkey = 140 and a.status in (1, 'Manually Provisioned') and ar.SOURCE = 'REQUEST'

However, I wasn't able to provision the access for AD for the one generated via Analytics. (Task ID: 342830)
I generated 'Add Access' task for the same entitlement via request, and it got completed successfully. (Task ID: 342843)
Do you happen to know the reason why it didn't complete for the one generated via Analytics? Am I missing something?

Thriller_0-1716928557219.png

 




@Thriller  Looks same two task same Ad Group , firstgroup it got completed, second task already group added respected user, so it will no action required error expected olny.


Thanks,
Raghu
If this reply answered your question, Please Accept As Solution and hit Kudos.

I need to assign an AD group when someone requests for an application let's say Hyperion. How can I do it? 

As mentioned above using Entitlement Map

 


Regards,
Rushikesh Vartak
If you find this response useful, kindly consider selecting 'Accept As Solution' and clicking on the 'Kudos' button.

Hi @rushikeshvartak 
I don't understand how this works. I need an AD group provisioned for the user whenever a new account gets created via ARS request for Hyperion

Can you share logs


Regards,
Rushikesh Vartak
If you find this response useful, kindly consider selecting 'Accept As Solution' and clicking on the 'Kudos' button.

Thriller
New Contributor III
New Contributor III

Hello,
I added in below code and I was able to generate an 'Add Access' task for AD

select distinct u.username, a.accountkey as acctKey, 'Provision Access' as Default_Action_For_Analytics, a.name as accName, u.userkey as userKey, 171674 as entvaluekey from users u, user_accounts ua, accounts a, arstasks ar where u.userkey = ua.userkey and ua.accountkey = a.accountkey and a.ARSTASKKEY = ar.TASKKEY and a.endpointkey = 140 and a.status in (1, 'Manually Provisioned') and ar.SOURCE = 'REQUEST'

However, I wasn't able to provision the access for AD for the one generated via Analytics. (Task ID: 342830)
I generated 'Add Access' task for the same entitlement via request, and it got completed successfully. (Task ID: 342843)
Do you happen to know the reason why it didn't complete for the one generated via Analytics? Am I missing something?


Hello,
I added in below code and I was able to generate an 'Add Access' task for AD

select distinct u.username, a.accountkey as acctKey, 'Provision Access' as Default_Action_For_Analytics, a.name as accName, u.userkey as userKey, 171674 as entvaluekey from users u, user_accounts ua, accounts a, arstasks ar where u.userkey = ua.userkey and ua.accountkey = a.accountkey and a.ARSTASKKEY = ar.TASKKEY and a.endpointkey = 140 and a.status in (1, 'Manually Provisioned') and ar.SOURCE = 'REQUEST'

However, I wasn't able to provision the access for AD for the one generated via Analytics. (Task ID: 342830)
I generated 'Add Access' task for the same entitlement via request, and it got completed successfully. (Task ID: 342843)
Do you happen to know the reason why it didn't complete for the one generated via Analytics? Am I missing something?

Thriller_0-1716982193656.png