Duplicate remove access tasks generated from User Update Rule for AD logical endpoints

[miteshparekh]

Hello Guys,

We have a logical endpoint setup for AD application (Parent endpoint and child endpoints).

We have setup User Update Rule to remove all access of users.

Once the rule is triggered we see that the remove access tasks are generated for both parent endpoint and child endpoints. This is creating duplicate remove access tasks as same accesses exist in parent endpoint and child endpoint.

One way to restrict this is by adding only parent endpoint in the remove access. But this will lead to adding all the endpoints manually where access needs to be removed. We cannot use the remove 'all' endpoint configuration here. This makes the rule static as we need to add endpoints manually.

Is there any other way to avoid the creation of duplicate remove accesses?

When we keep remove all access and accounts, it creates only 1 remove account task for the parent endpoint. No remove account tasks are created for child endpoints here. So, remove all accounts is working fine and we need similar behavior for remove all accesses. 

Thanks

[sudeshjaiswal]

Hello @miteshparekh,

This is the expected behavior , if you dont want the task to be created for the child endpoint please use the actionable analytic to deprovsion the access.

Thanks.

[Abhinav]

Hi,

In our case, we are using END Date in child's access request. So, as soon as End Date is reached, 'Remove Access' task is getting triggered for both Child as well as Parent End Point.

These accesses are only part of Child endpoint, and during Add access, only ONE task (for Child Endpoint) is getting triggered, then how does duplicate tasks are getting generated in case of 'Remove Access.'

How can we STOP task for Parent endpoint.

Thanks,

[sudeshjaiswal]

Hello @miteshparekh,

Can you please check if   'Create Dependent Entitlement Task for Remove Access' is enabled on endpoint side.

note:- enabling this setting also creates Remove Access tasks for parent and child roles when a user requests for removing an existing role that is linked to a child role.

For Ref:- https://docs.saviyntcloud.com/bundle/EIC-Admin-v23x/page/Content/Chapter02-Identity-Repository/Viewi... 

Thanks

[miteshparekh]

@sudeshjaiswal  Thanks for your inputs. Above configuration is disabled at endpoint.

[sudeshjaiswal]

Hello @miteshparekh,

Please utilize actionable analytics to deprovision access.

Thanks.