Birthright Enterprise Role not getting revoked upon condition not matching.

[Santosh]

Hello there, we have a birthright enterprise role auto assign Technical Rule in place to assign role based on a job title. I have checked the box for Remove Birthright Access if condition fails. The Technical rule is being triggered by User Update rules. When the title is being changed/ updated (Mover Scenario), the old enterprise role still exists on the user profile. How can I revoke the old enterprise and only assign the new role based on new job title?

[PremMahadikar]

Hi @Santosh ,

Regarding technical rule:

1. Only Remove access tasks will be generated if condition fails and account won’t be removed

2. Also only access/entitlement/role that are granted through same birthright will be revoked.

Also, check if this is enabled in global config:

Admin --> Global Configurations --> Rules --> Settings  and check if the below config is enabled or not

Config Name: For Remove Birthright Task check if Access is Assigned From Rule

If it is not enabled, can you enable the same by checking the box and validate if that resolves your issue

If this resolves/helps, please consider selecting Accept As Solution and hit Kudos

[Santosh]

@PremMahadikar  That checkbox option is not available for me. I am on version 24.3. The only condition on Technical rule is user.statuskey equals 1.  The checkboxes for both Birthright and Revoke are selected. 

The condition on user Update rule are;

1.  Users.statuskey =1 AND Users.title is not null  (Trigger when user is created from import)

2. Users.title is updated AND Users.statuskey =1 (Trigger when user is updated from import)

What i realized was, upon termination though, both roles were removed from the user's profile.

[NM]

Hi @Santosh , was all the entitlement of enterprise role assigned from the rule?

Check assignedfromrole and assignedfromrule

[Santosh]

@NM  We did a CSV upload for the roles (along with the entitlements within it). Check assignedfromrole and assignedfromrule, are you suggesting me to include this on my User Update rule?

[rushikeshvartak]

Validate under View Existing access - Assigned From Roles Column

[Manu269]

@Santosh check this post :

When to use the Repair Role to User Mapping (Role ... - Saviynt Forums - 26462

We had similar issue

[Santosh]

Hi @Manu269 , our use is to assign the enterprise roles dynamically based on user.title to the new users who gets onboarded. The roles are already available in Saviynt. The assigning worked, removing worked but when user's title updated (Mover Scenario), user ended up with both enterprise roles, the one they initially got and new role based on their new title, for which i'm seeking solution. So that user will not have more access than they should at any time.