importGroupHierarchy functionality when set to true vs false

[kharalson]

All group hierarchy, both parent, child and lateral, is presumed to have been brought in due to having the importGroupHierarchy set to true. Within our Active Directory, accounts with membership in a group have inherited membership within the parent group, but they do not inherit membership to other subgroups of the parent or membership group. For example, assume group A has subgroups A.1 and A.2. Then A.1 has subgroups A.1.1 and A.1.2. The Account is defined as a member of Group A.1 within Active Directory. Following a Full Access import, the Account's hierarchy and Associated Entitlement for the account in Saviynt reflects the account's membership in all 5 groups shown in the example below, but in reality, the account is only a member of Group A.1 and Group A via inheritance. Therefore, the account only has accesses for those 2 groups. How do we configure the groupImportMapping so that the account's Accesses/Entitlements are reflected correctly?

Current groupImportMapping configuration:

"importGroupHierarchy": "true",
"entitlementTypeName": "",
"performGroupAccountLinking": "true",
"importnestedmembershipoutofscope": "true",
"incrementalTimeField": "whenChanged",
"groupObjectClass": "(objectclass=group)",

Example:

                                                               Group A

                             Group A.1                                                  Group A.2

            Group A.1.1           Group A.1.2 

[Dhruv_S]

When importGroupHierarchy is set to true, it imports the group which is member of the group. Entire hierarchy of the group and associated account is imported. Currently this is how the product is designed.

[kharalson]

Groups unrelated to the account were imported. Appearance is that groups were imported due to their association to other groups the account was associated to. See attachment.

[NM]

Hi @kharalson so you are saying .. even though user is not member of A2 you can still see a reference in saviynt?

[kharalson]

Correct. Although the account is only a member of Group A1 which would inherit Group A, both the Entitlement Hierarchy and the Associated Entitlement are also showing Group A.1.1, Group A.1.2, and Group A2 which are not inherited memberships.

I have attached a pdf reflecting the 2 groups that should be reflected and the groups that are being reflected in Saviynt.