Provisioning examples
Quick answer
These examples show how a provisioning plan is structured and how account requests add or remove entitlements.
Key takeaways
- Provisioning plan structure
- Account request add/remove
- Attribute requests
- Adapt to target schema
A provisioning plan is the structured description of the change IdentityIQ will make on a target. These examples show how account and attribute requests are assembled, the building blocks behind every automated grant and revoke.
Add a group to an account
import sailpoint.object.ProvisioningPlan;
import sailpoint.object.ProvisioningPlan.*;
AccountRequest ar = new AccountRequest();
ar.setApplication("Active Directory");
ar.setOperation(AccountRequest.Operation.Modify);
ar.add(new AttributeRequest("memberOf", Operation.Add, "CN=Finance-RW,OU=Groups"));
ProvisioningPlan plan = new ProvisioningPlan();
plan.add(ar);Disable an account (leaver)
AccountRequest ar = new AccountRequest();
ar.setApplication("Active Directory");
ar.setOperation(AccountRequest.Operation.Disable);
plan.add(ar);Guidance
- Use the right operation, Add/Remove/Set on attributes; Create/Modify/Disable/Delete on accounts.
- Let policy run, do not bypass SoD where governance is expected.
- Verify with the next aggregation that the change took effect.
Common pitfalls
- Wrong operation (Set instead of Add) clobbering values.
- Assuming success without confirming on the target.
- Bypassing policy where it should apply.
Want to learn this properly?
Our live, instructor-led SailPoint Training covers this hands-on, with real projects and a certification path.
Check your understanding
What does a provisioning plan describe?
- A. The set of changes to make on a target system.
- B. Add, remove, set and others on attributes.
- C. A request to change one account, containing attribute requests.
Show answer
A. The set of changes to make on a target system.
The set of changes to make on a target system.
What is an AccountRequest?
- A. Add, remove, set and others on attributes.
- B. The set of changes to make on a target system.
- C. A request to change one account, containing attribute requests.
Show answer
C. A request to change one account, containing attribute requests.
A request to change one account, containing attribute requests.
What operations exist?
- A. Add, remove, set and others on attributes.
- B. A request to change one account, containing attribute requests.
- C. The set of changes to make on a target system.
Show answer
A. Add, remove, set and others on attributes.
Add, remove, set and others on attributes.