Identity Lifecycle Management and Provisioning
Identity cubes and the refresh cycle
The identity cube is the assembled record of one person: attributes from the authoritative source, links to accounts, assigned and detected roles, entitlements and work items. Lifecycle behaviour comes from repeated refresh cycles, so know which refresh options do what - refresh attributes, correlate, provision assignments, promote managed attributes. Turning off provisioning on a refresh is the classic cause of "the role was assigned but no account was created."
Joiner, mover, leaver
A joiner is created when an authoritative account is aggregated and correlated; a mover is a changed attribute that triggers role changes and update plans; a leaver is typically a disable followed, after a delay, by deletes. Requests flow through the Lifecycle Manager: a request creates a provisioning plan, the plan becomes a provisioning project, approvals generate work items, and execution sends operations to the connector.
Traps
- No Create provisioning policy on the target application, so an approved request completes with an error instead of an account.
- Expecting a Delete operation to disable the account; they are separate policies.
- Provisioning retries that recreate a failed operation because the previous failure was never diagnosed from the task result.
- Managed attribute promotion skipped because the option was not enabled on the refresh task.
Rule of thumb
Read the provisioning plan before the log: a correct plan with a failed execution is a connector problem, while a wrong plan is a policy, role or rule problem.