Birthright Role Assignment not working

[varunpuri]

Hi,

We have an enterprise role created in our environment which has to be provided to every user getting created within Saviynt.
We have created this enterprise role in the system and also configured one technical rule to ensure that the user gets this role. But, this role is NOT tagged to any entitlement on any downstream system. Just this role has to be assigned.

Problem : When we create the user through import, we can see that in the logs, Saviynt has picked up this role for assignment, but eventually has not assigned it. Can you please help here in understanding the issue ?

Best Regards,
Varun

[rushikeshvartak]

Every role should have at least one entitlement tagged to it. 

what is rational behind not keeping any entitlement tagged to role ?

[varunpuri]

Hello @rushikeshvartak ,

We have to run the initial load for around 2K users in Saviynt (first time data load from source system and then initial account sync from target systems).
These users already have AD groups assigned to them in the target and those groups will come in as entitlements when we run the account import from AD.
But, these users will not get the Role in Saviynt. In order to provide these initial set of users, the relevant roles, we just configured Roles within the Technical Rules but did not associate Roles with any entitlement.
As you mentioned, without entitlement attached to the Role, Saviynt is not assigning only Role to the user via Technical Rules.
Any other way to achieve this apart from the CSV upload procedure to associate Role with user ?

Best Regards,
Varun

[pmahalle]

Hi @varunpuri ,

In order to achieve your use case, assign enterprise roles to those 2K users using Bulk Upload request,  instead of creating enterprise role without entitlements, which will not assign enterprise role to those users. Bulk Upload request will help you to assign Enterprise role as well as not assign same AD group twice to users.

Follow below steps to assign Enterprise roles using bulk upload option after AD access recon so that users already have entitlements/ groups assigned in Saviynt.

1. Attached the workflow (preferably the auto approval workflow and do not use OOTB workflow) under Global configurations > Request > Bulk > Auto Approve Workflow for Multiuser request upload. 

2. Navigate to Request Home --> Request Access for Others - Multi Users -->Actions -->Bulk Upload Request.

3. Browse and attach the excel file. I have attached the sample file here, update with your details and don't change the format while saving the file.`

4. Select "What type of request do you want to upload?" : Access

5. Click Run Now.

6. After you upload the file, it will create completed Add Access task with status "No Action Required" since user already had entitlements assigned present in an enterprise role and also assign enterprise role.

Please let me know if it helps.

[varunpuri]

Hello @pmahalle ,

Does this method of bulk associating Roles with Users also ensure that a particular user also gets the account of the application whose entitlements are bundled within the Enterprise Role which is being associated with the given user through this method ?

Will a corresponding New Account task also get generated (for the application whose entitlement is bundled within the Role which is being assigned to the user) with status "No Action Required" ? 

I am asking this question because at the database level also, I saw that there is a table by the name role_user_account which stores the association between user and role through an account linkage.

But there is NO table which stores only the linkage between role and user. Please correct me if I am wrong.

Best Regards,
Varun

[pmahalle]

Hi @varunpuri ,

Does this method of bulk associating Roles with Users also ensure that a particular user also gets the account of the application whose entitlements are bundled within the Enterprise Role which is being associated with the given user through this method ?

--> Yes, it should. When you assign the roles through bulk upload, in the backend, it works like raising request through ARS. You can check it.

Will a corresponding New Account task also get generated (for the application whose entitlement is bundled within the Role which is being assigned to the user) with status "No Action Required" ?

--> No it will not create New Account task with No Action Required if account already exists.

[rushikeshvartak]

Use bulk upload using excel

Request Home --> Request Access for Others - Multi Users -->Actions -->Bulk Upload Request —> Role

https://docs.saviyntcloud.com/bundle/SSM-User-v55x/page/Content/02-mang-ars/ars-req-accs-mult-usr.ht...

[varunpuri]

Thank You, @pmahalle and @rushikeshvartak ,

One more question, I tried to associate the Role with User using Upload Role Associations feature in the Role Management page. I was able to associate the Role with user by specifying the column Role Users in the csv. It worked. Is this method not an appropriate way of achieving this use case ?

Best Regards,
Varun

[rushikeshvartak]

Using Admin having some limitation hence use from ARS/Request modufle