User Update Rule - Remove Access Action - Correct Behavior for Remove Ent Task in Entitlement Map

[Charitha]

Hi,

Use case: I am trying to create a use case where through user update rule, remove access of one entitlement it should automatically remove other entitlements specified.

Implementation Details:

For this I tried using the "Remove Ent Task" from Entitlement Map.

• Ent 1 of Ent type 1 (request option=table) from Endpoint 1
• Ent 2 of Ent type 2 (request option=table) from Endpoint 2 which is mapped in Ent 1 under other entitlements.
• Request Filter, Add Dependent Task, Remove Ent Task are set to true
• Exclude Entitlement set to false.
• A user update rule is configured to invoke remove access task for Ent 1.

Issue: It is generating a pending task only for Ent 1 but not Ent 2.

Ask: I am expecting pending task generation for Ent 2 as well. Should I make any configuration changes to achieve this?

Best Regards

Charitha.

[NM]

Hi @Charitha , is the entitlement  from different endpoint still assigned to the account?

Can you try this via ars request.

We saw the same behaviour most likely a bug but as our use case was changed couldn't test all edge cases

[Charitha]

Hi @NM ,

Yes. Ent 2 from Endpoint 2 is still assigned to the account when the user update rule got invoked and generated remove access task only for Ent 1 from Endpoint 1.

Our use cases are as follows:

1. Add Access: Ent 1 is requested through ARS. With the help of 'Add Dependent Task' set as 'true' in the Entitlement Map, it is able to generate Add access task for both Ent 1 from Endpoint 1 and Ent 2 from Endpoint 2.
2. Remove Access: During leaver lifecycle event, we are specifically implementing user update rules to remove accesses. During that scenario, task is generating for Ent 1 from Endpoint 1 alone and no task is generating for Ent 2 from Endpoint 2. 

Best Regards,

Charitha.

[rushikeshvartak]

• This is expected behavior from product perspective 
• Please raise idea ticket for enhancement 

[Charitha]

Hi @rushikeshvartak ,

So are you saying, 'Remove Ent Task' work only if entitlements are from same endpoint?

Best Regards,

Charitha

[rushikeshvartak]

Tasks will not be created from entitlement mapped under entitlement map