Add access task is triggering Update account task on its completion

[VamsheeVazza]

Hi,

I have a case for one of the application. When we raise an Add Access request for the endpoint, this created an add access task. upon the add access task completion it is triggering an update task. 

Attached the screenshot.

[vivek9237]

@VamsheeVazza not able to see the screenshot. Please share.

[adriencosson]

Hi @VamsheeVazza ,

There are 2 ways of achieving this.

• Add a dynamic attribute that is mandatory and must be updated by the user to trigger the associated Update Account Task for the same application
• Build an Analytics that is doing the following :
  • Look for created Add Access Tasks that were Completed in the past X minutes
  • Add the following columns :
    • The associated account's accountkey (with alias 'acctkey')
    • 'Update Account' as 'Default_Action_for_Analytics'
  • Add in the "Allowed Actions" the "Update Account" option.
  • Save this report in a dedicated Category
  • Create a Job called "RunAllAnalyticsV2" to specify the same category and tick the "Executed Defaut Action for Analytics" option
  • Schedule this job every X minutes (same frequency as the condition above to prevent more than one 'Update Account' task created.

Let me know if this helps.

[VamsheeVazza]

I'm already seeing an update task
i dont want to see the update task.
After add access task is completed the request should be closed. that is what i need.

[Saathvik]

Do you have any dynamic attributes in place?

[VamsheeVazza]

yes

[rushikeshvartak]

This is expected behavior. @VamsheeVazza 

• If request having dynamic attributes and those are getting stored in accounts column
• Update account task will be generated.
• In order to get rid of it remove account column from Dynamic attribute configuration
• 

[Saathvik]

@VamsheeVazza : Then it is expected behaviour because you might be mapping that dynamic attribute to account column. You can try removing mapping account column this should go away.

[adriencosson]

@VamsheeVazza, So you need to auto close these Update Account tasks since they are doing nothing on target system right ?

If so, I replied to your other topic with a suggestion I am personally using whenever I need tasks to be closed without going through provisioning : 

You can create an Enhance Query job to fetch the Remove Access tasks that would need to not be provisioned but completed in Saviynt.

Schedule this Enhanced Query Job more frenquently than Provisioning Job to set the task status as complete for these tasks.

Reference : https://forums.saviynt.com/t5/identity-governance/how-do-you-process-revoke-access-tasks-pulled-in-a...