Hello,
Has anyone faced any requirement to remove all entitlements from an account while triggering disable account request ?
We know there is a configuration which will trigger enable/disable account request while entitlement access. Do we have similar configuration in revers way ?
I'm working on VIA 7.0.2 P01HF01.
Thanks !!!
How is the CR to disable account created?
If the account disable is configured in a rule (Provisioning - Termination), then you can enable Revoke user entitlements as well.
Unfortunately the request is from Request Form (Account Table with action - control type)
Consider the following:
There might be other approaches to achieve the desired functionality
Thanks Boris.
However, we need to consider the exception as well, isn't it. For example in your 1st option we need to check if the provisioning command successfully processed the action by calling the connector (we need to read the response message of the connector and assign task to manual team accordingly) what would have been always easy if we use fulfillment handler than a provisioning command.
I was thinking of a configuration where RSA can take care of that automatically like its handling in termination rule
Yes, you always need to consider exceptions.
Here is a nice feature where you can check the status of a provisioning node - 000034403 - Provisioning node CommandStatusCode and CommandStatusMessage in RSA Identity Governance & Lifecycle
If not option #1, try option #2
I'm not familiar with a similar configuration like in the rule.
Hi Amit Khatua have you considered adding the following field to your form:
This will automatically create a "DisableAccount" change along with your removed entitlements.
If you leave it without an Account Filter, it will disable all available user accounts. Otherwise you can add a filter based on Application for example to specify which account should be disabled (based on how your form works).
Mostafa, I don't think adding that type of a field (Accounts non visual) will create a CR to remove all associated authorizations from the account.
As far as I know, the behavior of that field is similar to Account table with Actions field, and it will create a CR with 1 change item (disable account)
Hi Amit Khatua have you considered adding the following field to your form:
This will automatically create a "DisableAccount" change along with your removed entitlements.
If you leave it without an Account Filter, it will disable all available user accounts. Otherwise you can add a filter based on Application for example to specify which account should be disabled (based on how your form works).