000038365 - A completed change request to remove Aveksa Application/Directory entitlements from a user does not remove the access from the user in RSA Identity Governance & Lifecycle

Document created by RSA Customer Support Employee on Jan 21, 2020Last modified by RSA Customer Support Employee on Mar 11, 2020
Version 5Show Document
  • View in full screen mode

Article Content

Article Number000038365
Applies ToRSA Product Set: RSA Identity Governance & Lifecycle
RSA Version/Condition: 7.0.x, 7.1.x
IssueA change request to remove an Aveksa Application or Directory entitlement shows as completed yet the access still shows on the user's access tab (Users < Users < {user name} > Access tab.)

In the following example, a request to remove the Aveksa Application: Exceptions Manager entitlement from a user was completed but the access was not removed from the user.
User-added image

User-added image

CauseWhen a user is assigned to an Application or a Directory as a Business Owner, Technical Owner, or Violation Manager, they are automatically assigned the required Aveksa Application/Directory entitlement(s) for these roles. This issue occurs if the required entitlement(s) is removed from the user without removing them as the Business Owner, Technical Owner, or Violation Manager of the Application/Directory.

The fact that the change request shows the access has been removed when it has not been removed has been reported in engineering ticket ACM-103280.
ResolutionThe proper way to remove this type of access from a user is to reassign their role as a Business Owner, Technical Owner, or Violation Manager to another user It does not make sense to remove the access directly since the user requires this access to be a Business Owner, Technical Owner, or Violation Manager.

This issue is being investigated by the Engineering team in order to provide a permanent resolution in a future release.
WorkaroundTo remove the Aveksa applilcation access associated with the Business Owner, Technical Owner, and Violation Manager roles, determine which Application/Directory to which the user is assigned as one of these roles and reassign the role to another user. 

For example, to resolve the example presented in this RSA Knowledge Base Article:
  1. Navigate to Users > Users > {user name} > Access tab
  2. Click on the i icon for the Application : Exceptions Manager entitlement.
  3. In the pop-up dialog box, click on the Security Scope drop-down.
  4. Note the Name(s) listed. These are the Applications and/or Directories to which the user is assigned as a Violation Manager.

User-added image


  1. Navigate to Resources > Applications/Directories > {Application name} > Edit.
  2. Scroll to the bottom  of the page.
  3. Click on Violation Manager and change the existing Violation Manager to a different user.
  4. Click OK > OK to save your changes.

User-added image


  1. Navigate to the Users > Users > {user name} > Access tab and note that the Application:Exceptions Manager entitlement has been removed. If the user has no other Aveksa entitlements, the Aveksa application account associated with that user is also removed.