Announcing the Saviynt Knowledge Exchange unifying the Saviynt forums, documentation, training,
and more in a single search tool across platforms. Read the announcement here.

Birthright Enterprise Role not getting revoked upon condition not matching.

New Contributor III
New Contributor III

Hello there, we have a birthright enterprise role auto assign Technical Rule in place to assign role based on a job title. I have checked the box for Remove Birthright Access if condition fails. The Technical rule is being triggered by User Update rules. When the title is being changed/ updated (Mover Scenario), the old enterprise role still exists on the user profile. How can I revoke the old enterprise and only assign the new role based on new job title?



Hi @Santosh ,

Regarding technical rule:

1. Only Remove access tasks will be generated if condition fails and account won’t be removed

2. Also only access/entitlement/role that are granted through same birthright will be revoked.


Also, check if this is enabled in global config:

Admin --> Global Configurations --> Rules --> Settings  and check if the below config is enabled or not

Config Name: For Remove Birthright Task check if Access is Assigned From Rule

If it is not enabled, can you enable the same by checking the box and validate if that resolves your issue



If this resolves/helps, please consider selecting Accept As Solution and hit Kudos

@PremMahadikar  That checkbox option is not available for me. I am on version 24.3. The only condition on Technical rule is user.statuskey equals 1.  The checkboxes for both Birthright and Revoke are selected. 

The condition on user Update rule are;

1.  Users.statuskey =1 AND Users.title is not null  (Trigger when user is created from import)

2. Users.title is updated AND Users.statuskey =1 (Trigger when user is updated from import)


What i realized was, upon termination though, both roles were removed from the user's profile.

Valued Contributor
Valued Contributor

Hi @Santosh , was all the entitlement of enterprise role assigned from the rule?

Check assignedfromrole and assignedfromrule

New Contributor III
New Contributor III

@NM  We did a CSV upload for the roles (along with the entitlements within it). Check assignedfromrole and assignedfromrule, are you suggesting me to include this on my User Update rule?

Validate under View Existing access - Assigned From Roles Column



Rushikesh Vartak
If you find this response useful, kindly consider selecting 'Accept As Solution' and clicking on the 'Kudos' button.


@Santosh check this post :

When to use the Repair Role to User Mapping (Role ... - Saviynt Forums - 26462

We had similar issue

Manish Kumar
If the response answered your query, please Accept As Solution and Kudos

New Contributor III
New Contributor III

Hi @Manu269 , our use is to assign the enterprise roles dynamically based on user.title to the new users who gets onboarded. The roles are already available in Saviynt. The assigning worked, removing worked but when user's title updated (Mover Scenario), user ended up with both enterprise roles, the one they initially got and new role based on their new title, for which i'm seeking solution. So that user will not have more access than they should at any time.