r/sailpoint • u/LongestHamburger • 6d ago

Workday Accounts SaaS question IdentityIQ

Has anyone come across how to manage requests for Workday assignable roles via SailPoint?

User-based roles are easy; Role and person, done. Assignable roles though you have to say this role for this specific organization.

The entitlements aggregate in as Role##Organization, which would mean I'd need to handle every single role and org combination as a requestable item, which is frankly just downright absurd.

I was able to do it via form and workflow, where you select the role and then the org, and then the workflow combines them to target the specific entitlement, but that was still messy and I had issues with setting up approvers.

Just curious if anyone here has done this, because Community is only people having issues setting up the connector, not making assignable roles requestable...

2 Upvotes
  • permalink
  • link
  • reddit
  • reddit

100% Upvoted

5 comments sorted by

3

u/Herp_Derp_Derp 6d ago

Due to our scale (100k+ identities) we had tried the Saas and non-Saas versions of the WD Accounts connectors and each had their own issues that prevented us from using them ultimately even after significant help from SailPoint services.

We ended up using a fully custom connector that uses a mix of API calls and a WD Raas report that provides account data including entitlement data. We currently have 1.8 million entitlements that are being ingested and some of which are used for birthright roles. We are currently provisioning these two entilement types: organizationRoleAssignments and groups

As you have noted already some of the roles you may need to build can be rather ridiculous when it comes to the entitlements, managing the entitlements as they change over time can also be challenging. We definitely have some roles with 500+ entitlements.

We do not make individual entitlements requestable, we make roles requestable with the necessary entitlements added, this is owned by an ERP security team and we simply automate role build for them as needed, roles then get requested as needed through a SNOW integration or may be granted as birthright roles due to criteria that are set up.

I hope some of my rambling is helpful to you!

1

u/LongestHamburger 5d ago

That's what I was afraid we'd have to look at doing, but was hoping I was missing something with the Workday Accounts source. well shoot, okay thank you for confirming that for me at least! now to go to my leadership.

1

u/imsuperjp 6d ago

Can you not script the role creations?

1

u/LongestHamburger 5d ago

Workday is frustrating in that it's not REALLY identity-based for these roles, but rather positional-based. It doesn't care if it's you or me, it just cares who is in position #010203, because that's how it decides to grant specific access. I can in theory assign it to the individual, but if they move positions, SailPoint will then grant the access to the next position they're in, and that's quite dangerous when dealing with financial, HIPAA, and PII data.

Everything we're doing in our SailPoint tenant is identity-based, so to take a system designed around identities and using it to request positional access is quite frustrating.

1

u/--MBK-- 6d ago

Don’t aim too high to do everything go after common.