Announcing the Saviynt Knowledge Exchange unifying the Saviynt forums, documentation, training,
and more in a single search tool across platforms. Read the announcement here.

Birthright Enterprise Role not getting revoked upon condition not matching.

Santosh
New Contributor III
New Contributor III

Hello there, we have a birthright enterprise role auto assign Technical Rule in place to assign role based on a job title. I have checked the box for Remove Birthright Access if condition fails. The Technical rule is being triggered by User Update rules. When the title is being changed/ updated (Mover Scenario), the old enterprise role still exists on the user profile. How can I revoke the old enterprise and only assign the new role based on new job title?

7 REPLIES 7

PremMahadikar
All-Star
All-Star

Hi @Santosh ,

Regarding technical rule:

1. Only Remove access tasks will be generated if condition fails and account won’t be removed

2. Also only access/entitlement/role that are granted through same birthright will be revoked.

 

Also, check if this is enabled in global config:

Admin --> Global Configurations --> Rules --> Settings  and check if the below config is enabled or not

Config Name: For Remove Birthright Task check if Access is Assigned From Rule

If it is not enabled, can you enable the same by checking the box and validate if that resolves your issue

PremMahadikar_0-1717216293349.png

 

If this resolves/helps, please consider selecting Accept As Solution and hit Kudos

@PremMahadikar  That checkbox option is not available for me. I am on version 24.3. The only condition on Technical rule is user.statuskey equals 1.  The checkboxes for both Birthright and Revoke are selected. 

The condition on user Update rule are;

1.  Users.statuskey =1 AND Users.title is not null  (Trigger when user is created from import)

2. Users.title is updated AND Users.statuskey =1 (Trigger when user is updated from import)

 

What i realized was, upon termination though, both roles were removed from the user's profile.

NM
Valued Contributor
Valued Contributor

Hi @Santosh , was all the entitlement of enterprise role assigned from the rule?

Check assignedfromrole and assignedfromrule

Santosh
New Contributor III
New Contributor III

@NM  We did a CSV upload for the roles (along with the entitlements within it). Check assignedfromrole and assignedfromrule, are you suggesting me to include this on my User Update rule?

Validate under View Existing access - Assigned From Roles Column

rushikeshvartak_0-1717466933693.png

 


Regards,
Rushikesh Vartak
If you find this response useful, kindly consider selecting 'Accept As Solution' and clicking on the 'Kudos' button.

Manu269
All-Star
All-Star

@Santosh check this post :

When to use the Repair Role to User Mapping (Role ... - Saviynt Forums - 26462

We had similar issue

Regards
Manish Kumar
If the response answered your query, please Accept As Solution and Kudos
.

Santosh
New Contributor III
New Contributor III

Hi @Manu269 , our use is to assign the enterprise roles dynamically based on user.title to the new users who gets onboarded. The roles are already available in Saviynt. The assigning worked, removing worked but when user's title updated (Mover Scenario), user ended up with both enterprise roles, the one they initially got and new role based on their new title, for which i'm seeking solution. So that user will not have more access than they should at any time.