OKTA - Admin Roles

 

SailPoint IIQ - Role Request Flow - Account v/s No-Account

 

When a business role is requested:

• Add the requested business role to the Identity Cube.

• Determine from the business role being requested what IT roles are required by this role. 

• From the IT role, determine what entitlements are needed.

• Does the user have an application account for the application? If yes, provision the entitlement to grant the user the appropriate access that was requested. If no, expand the request to also request an account to be created.

OIM Query: List of roles without access policy attached

SELECT
  ugp1.ugp_name AS "Role Name",
  ugp1.UGP_DISPLAY_NAME AS "Role Display Name",
  ugp1.UGP_DESCRIPTION AS "Description",
  ugp1.UGP_CREATE AS "Create Date"
FROM ugp ugp1
WHERE ugp1.ugp_name not in (select  ugp.ugp_name
from pol
left join pog on pog.pol_key=pol.pol_key
join ugp on ugp.ugp_key = pog.ugp_key)
;