Deprovision certain access only for user update rule

[println-titan]

Hi all,

How can I deprovision certain access only for user update rule?
Appreciate any input, thank you

[naveenss]

Hi @println-titan 

Can you please elaborate on the requirement? Do you want to deprovision certain access using the user update rule upon user metadata changes?

[println-titan]

Hi @naveenss ,

Thanks for the prompt response. Yes, we only want to deprovision certain access using user update rule upon user attribute change.

For example, user account in AD is a member of Account Receivable (AR) and Account Payable (AP).
Upon change of user's department attribute, I want to deprovision the AP access but keep the AR

[shivmano]

@println-titan  - user update rules have a specific action 'Revoke selected access' you can use that action to specify the endpoint and entitlement to be revoked for the particular endpoint

[rushikeshvartak]

Use below option https://docs.saviyntcloud.com/bundle/EIC-Admin-v23x/page/Content/Chapter05-Policies/Updating-User-Up... 

Revoke Selected Access

Remove Access Task

From Release v5.5.0SP2 onwards, Revoke Selected Access action is introduced using which you can trigger remove access tasks for selected entitlements and endpoints without deactivating the account. Selecting Revoke Access allows you to select the Endpoint (All or specific endpoint) and specify the Entitlements under the endpoint for which you want to create remove access task. Based on the condition mapped, the revoke access action is triggered and remove access tasks are created for the respective endpoint.