Ability to review ownership and update entitlement owners when a user's attribute changes

[krecpond]

When the JobCode (or any defined user attribute) of an existing active user changes, the system must have the ability to

1. Trigger an access review to the current manager of the identity to review the mover’s current accesses.

2. Trigger an entitlement ownership review if the mover happens to be an entitlement owner subject to the below requirements:

   1. Ownership review must be generated to the previous manager of the mover if the manager has also changed in the mover transaction received from HR source.

   2. Ownership review must be generated to the current manager of the mover if the manager has NOT changed but only the JobCode has changed.

   3. For a mover who owns entitlements less than a predetermined number, generate an ownership review within the system to the owner’s manager (previous or current as determined by point a above) to make the required ownership changes.

   4. For a mover with the number of entitlements greater than or equal to a predetermined number, generate an ownership review from the system as a notification to the owner’s manager (previous or current as determined by point a above) to make the required ownership changes. The email is then forwarded to the support team to upload the attachment received from the owner to reflect the ownership changes in the system.

   5. If the ownership changes are made via point c or d above, the system must update the entitlement owner in Saviynt.

[NM]

Hi @krecpond you can launch a campaign via user update rule.. but only user manager is supported for now not entitlement one.

You can use owner in terminate to handle other scenarios.

[krecpond]

Can you please elaborate more on this recommendation?

[rushikeshvartak · Accepted solution]

• Use preprocessor to maintain flag on users customproperty along with date
• schedule entitlement owner campaign on daily basis based on field  

[krecpond]

These recommendations will definitely not work. Please see the entire requirements. Saviynt does not support making changes during a campaign while here the requirement is to make changes to the owner, description, CMDB ID mapped to the entitlement amongst other things. Saviynt does not have the configurations to enable such processes in the product. If someone has done similar requirements, I would like to hear how it was implemented.

Even in other IGA products, this is a custom workflow. So we are looking to see if such a custom process can be triggered in Saviynt for reviewers to make changes to entitlement metadata.