My query is regarding entitlement collector behavior.
When configuring entitlement collector for application roles, on the 'Mapping for application role attributes' screen, the 'Application Roles Query' (Application Role Data) is defined to collect unique application roles.
On the next screen i.e. 'Mapping for application role based entitlements', the 'App Roles for Accounts Query' (Account Data) is defined to collect and map accounts to the entitlements (application roles) - which were collected by previous query.
However, the following is observed when I run the collection:-
If there are application roles (as per the 2nd query) which were not in the source for 1st query, these will be collected as well! i.e. The 2nd query i.e. 'App Roles for Accounts Query' also collects/ created application roles!
I think this is not the expected behavior as per design i.e. only the 1st query i.e. 'Application Roles Query' is supposed to collect application roles.
Kindly help confirm this.