Remove Entitlements from accounts

[indrahema95]

Hi,

I want to remove entitlements for few specific accounts from backend. What are the ways I can do this?

If there is any custom query for it, please let me know the query.

Regards,

Indranil Biswas

[dgandhi]

Can you remove the same from target and perform the recon?

[indrahema95]

Hi @dgandhi it's a disconnected app.

[dgandhi]

1. Delete query (not recommended by saviynt)

2. Another option I can think is , set Auto Approval WF for the application, and enabled Instant provision , now remove the entitlement from the account , the request will be auto approved and task will be automatically provisioned. Once the task is provisioned the access will be removed from the user account.

[indrahema95]

Hi @dgandhi The problem is, those are orphan accounts. 

[sk]

Removing from backend is not suggested way to do this? Can we know the reason why you want to do this from backend?

[indrahema95]

Hi @sk I am aware of that. But we have some accounts who are orphan and they don't have any active user accounts. I am just asking for the options here. If you have any please let me know. 

[pmahalle · Accepted solution]

Hi @indrahema95 ,

Create actionable analytics with deprovision access action for those specific accounts. Analytics will help you to create pending tasks and then manually complete those tasks.

[rushikeshvartak · Accepted solution]

Create actionable report with Deprovision Action

select a.name as accName,
'1' as userKey,
a.accountkey as acctKey ,
ev.entitlement_valuekey as 'entvaluekey',
ev.ENTITLEMENT_VALUE ,
e.ENDPOINTNAME,et.ENTITLEMENTNAME from account_entitlements1 ae
join accounts a on a.accountkey = ae.accountkey
join entitlement_values ev on ev.entitlement_valuekey = ae.entitlement_valuekey
join entitlement_types et on ev.entitlementtypekey = et.entitlementtypekey
join user_accounts ua on ua.accountkey = ae.accountkey
join users u on u.userkey = ua.userkey
join endpoints e on a.endpointkey = e.endpointkey
where ae.accountkey=1754599 and ae.entitlement_valuekey in (
1807285,1806831)

https://docs.saviyntcloud.com/bundle/EIC-Admin-v2021x/page/Content/Chapter17-EIC-Analytics/Configuri... 

Deprovision Access

When Deprovision Access is configured as an allowed action, it removes the entitlement from a particular account. When this action is performed on a record, a Remove Access task is created for removing access in the target application.

The Analytics query must have the columns given below:
entvaluekey- Entitlement value key of the entitlement which will be removed from the account.
acctKey - Accountkey of the account from which the entitlement access will be revoked.

Sample query:

• Schedule from Run All V2 Analytics Job

  SQL

  select ae1.entitlement_valuekey as entvaluekey,ev.ENTITLEMENT_VALUE,ae1.accountkey as acctKey, a.name, 'Deprovision Access' as 'Default_Action_For_Analytics' from account_entitlements1 ae1, accounts a , entitlement_values ev where a.accountkey = ae1.accountkey and ev.ENTITLEMENT_VALUEKEY=ae1.ENTITLEMENT_VALUEKEY and a.endpointkey=12;

• Schedule from Run All V1 Analytics Job

  SQL

  select ae1.entitlement_valuekey as entvaluekey,ev.ENTITLEMENT_VALUE,ae1.accountkey as acctKey, a.name, 'Deprovision Access' as 'Default_Action_For_Analytics' from account_entitlements1 ae1, accounts a , entitlement_values ev where a.accountkey = ae1.accountkey and ev.ENTITLEMENT_VALUEKEY=ae1.ENTITLEMENT_VALUEKEY and a.endpointkey=12;

This action can also be configured as a default action, i.e., it will be automatically performed when the Analytics control is executed.

[indrahema95]

Thanks @rushikeshvartak for the detailed information and help.

[ArvindKumar]

Hi, 

Additionally, you can also delete entitlements from accounts using a CSV upload as well. It will create deprovison tasks. 

Username	Endpoint	Account Name	Request Type	Entitlement Type	Entitlement Values
123	Salesforce-Prd	kumararv@app.prd	Remove Access	PermissionSet	ABC_SetupAccess

Regards, 

Arvind 

[ehrushikesh · Accepted solution]

You can either use actionable analytics to deprovision the access or use a campaign and revoke the access. This would create the tasks and manually complete the tasks.

Thanks,

Hrushikesh

[indrahema95]

Thnaks @ehrushikesh for the help.