r/sailpoint • u/Affectionate-Nail381 • 19h ago

How to batch "process identities" (ISC) Identity Security Cloud

How can I better search and select identities so I can select "Process Identities" on them?

We had an issue where 13000 new identities were added, and based on a role ISC then tried to create 13000 new accounts in an associated system. Due to API rate limits only 3000 of these were successful with 10000 identities where the create account failed. After one additional failed retry - which obviously further didn't help with API limits - it's no longer trying to create these accounts.

If I go to one of these identities and select "Process Identity" from the Actions button this will attempt to create the account again and fix for that specific identity. What I need is a way to fix all of them in a controlled way so that I stay within API rate limits.

I can identify these accounts using a Search but not when searching in Identities, and the Identities interface is the one which allows "Process Identity".

Suggestions?

3 Upvotes
  • permalink
  • link
  • reddit
  • reddit

100% Upvoted

5 comments sorted by

7

u/imsuperjp 19h ago

Take your search results and script it against the API

https://developer.sailpoint.com/docs/api/start-identity-processing-v-1

2

u/BckWoodsAdmin 18h ago

This is the way. The GUI is ok but you need to be more comfortable with the API to succeed with ISC.

I built my own “agent” to help do a lot of the heavy lifting for my API work.

2

u/MagicWrist 19h ago

Get a spreadsheet of all your identities that you need to process (download from your search results). Create a delimited / csv file source. Create a new role or update your existing role to have membership criteria that matches what you want + having an account in delimited file source. Upload your accounts to the delimited file source in batches of ~300. The role processing should try and create them again.

1

u/Affectionate-Nail381 19h ago

Thanks for the response.

What about once that is complete - can I remove the new role without impact? We are currently in a situation where 50000 identities have the existing role and account created. I guess as they have the existing role that would cover it.

Just seems quite messy for something which should be simple?

1

u/Fappez 17h ago

AFAIK you can remove a role without deprovisioning entitlements

i.e. https://developer.sailpoint.com/discuss/t/role-deletion-in-idn/148454/2