I'm trying to remove app-roles from a role and the requests are generated but there are no Account Changes being triggered.
The provisioning works for adding but not removing. Is there a certain setting I'm missing that is needed to enable this?
version: 7.0.1.122913 P02
That setting is enabled. This is specific to a specific Application set up. For other Applications the indirect changes are generated, though they are not app-roles.
In this case the user himself does not have that App-Role entitlement. Things to check:
#5. I see that in the "Missing Required Entitlements" section of the role that none of the actual users in the role have access to the app-role entitlement. When you look at the User's access, all that appears is the role itself, not the app-roles in the actual role.
The account has the app-role and the user has the account. But it seems that it doesn't trickle down to the user level. How would you enable that the app-roles trickle all the way down to the user level?
20 Users x 3 Entitlements = 60 Missing Entitlements
If the User Access tab only shows Roles and not the app-roles, this means it is something wrong on the collections side. The questions to ask:
Also which version and patch level are you on?
Looks like either the members of the Role don't actually have the App-role as an entitlement, or the Request workflow used might be missing setting to generate indirect items.
Could you go to Requests > Workflows > Overview > Assuming the above CR was generated by editing a Role and clicking Apply changes, Open the request workflow mapped for Role requests > Make sure the Generate Indirect Entitlements is checked) as in the below screenshot.