...
Throughout its life cycle, any role or resource assignment is subject to multiple changes. Depending on the order of these changes, the system configuration, and other influencing factors, the resulting outcomes may not always be intuitive or predictable. This page documents various scenarios and edge cases to help you identify potential issues and plan more effectively.
Shortening and Extending
Shortening an Assigned Assignment
When an assignment is already in place, its duration may be subject to change for various reasons:
...
In such cases, the valid-to date of the assignment will be updated to reflect the new valid-to date without requiring any additional actions. If the assignment initially required approval, no new approval process will be triggered, as the revised assignment duration remains within the time frame of the original approval.
Extending an Assigned Assignment
When an assignment is already in place, its duration may be extended for various reasons:
...
During this process, any existing assignments will transition to the deletion pending state until the approval is processed. However, even though the assignment is in this state, it will not be deprovisioned until the approval is either declined or the original valid-to date has passed.
Deny
Denies are an effective tool while building your role model. There are a few key rules that you should be aware of, when using those.
If you have assigned resource A through one role, and you have another role assignment that contains a deny to the resource A, the deny will have higher priority
If you have assigned resource A manually and you have role assignment that contains a deny to the resource A, the manual assignment will have higher priority
So to summarize the priorities:
Manual denies
Manual assignments
Automatic denies
Automatic assignments