Examples · LessonReviewed by Neelima, SailPoint Architect · Updated · Published · IdentityIQ 8.4 · all levels
SailPoint Provisioning examples
Examples of provisioning plans and policy handling.
Quick answer
These examples show how a provisioning plan is structured and how account requests add or remove entitlements.
Key takeaways
- Provisioning plan structure
- Account request add/remove
- Attribute requests
- Adapt to target schema
A provisioning plan is the structured description of the change IdentityIQ will make on a target. These examples show how account and attribute requests are assembled, the building blocks behind every automated grant and revoke.
Add a group to an account
import sailpoint.object.ProvisioningPlan;
import sailpoint.object.ProvisioningPlan.*;
AccountRequest ar = new AccountRequest();
ar.setApplication("Active Directory");
ar.setOperation(AccountRequest.Operation.Modify);
ar.add(new AttributeRequest("memberOf", Operation.Add, "CN=Finance-RW,OU=Groups"));
ProvisioningPlan plan = new ProvisioningPlan();
plan.add(ar);Disable an account (leaver)
AccountRequest ar = new AccountRequest();
ar.setApplication("Active Directory");
ar.setOperation(AccountRequest.Operation.Disable);
plan.add(ar);Guidance
- Use the right operation, Add/Remove/Set on attributes; Create/Modify/Disable/Delete on accounts.
- Let policy run, do not bypass SoD where governance is expected.
- Verify with the next aggregation that the change took effect.
Common pitfalls
- Wrong operation (Set instead of Add) clobbering values.
- Assuming success without confirming on the target.
- Bypassing policy where it should apply.
Want this with a live instructor and a lab tenant?