Leveraging Intelligent Recommendations for Operational Transformation. AMS Partners click HERE | EMEA/APJ Partners click HERE |
05/07/2024 01:49 AM
Ad groups should only be assigned to individuals who have been granted access to your disconnected application account. Similarly, in the case of deprovisioning, when the disconnected app account is removed, the Ad group should also be removed. Is there a way to address this scenario without relying on any analytics queries?
05/07/2024 03:17 AM - edited 05/07/2024 03:19 AM
@lakshman For this scenario based on query condition you filter and create Task
https://forums.saviynt.com/t5/identity-governance/add-access-actionable-analytics/m-p/66629#M41590
Sample:
select distinct a.accountkey AS 'acctKey', '656499' AS 'entvaluekey', u.enddate AS 'Termination Date', a.accountid, a.name as accName, u.userkey as 'userKey', u.username AS 'GUID', u.FIRSTNAME, u.LASTNAME, u.EMAIL AS USER_EMAIL, SYSDATE() AS RUNTIME, 'provisionaccess' as 'Default_Action_For_Analytics' from users u, user_accounts ua, accounts a, account_entitlements1 ae where a.status in ('ACTIVE','Manually Provisioned','1') and u.userkey = ua.userkey and ua.accountkey = a.accountkey and a.accountkey=ae.accountkey and a.endpointkey=XXX
05/07/2024 03:46 AM
1. Raghu, your question is valid, however, the situation is acceptable as long as there is no analytics query required to perform the tasks of provisioning or de-provisioning access to users in a disconnected Active Directory-based application.
05/07/2024 06:15 AM
Please use entitlement map concept for disconnected applications which will take care of add/ remove task of ad entitlement