Assignment Behavior

Introduction

Throughout its life cycle, any role or resource assignment is subject to multiple changes. Depending on the order of these changes, the system configuration, and other influencing factors, the resulting outcomes may not always be intuitive or predictable. This page documents various scenarios and edge cases to help you identify potential issues and plan more effectively.

Shortening and Extending

Shortening an Assigned Assignment

When an assignment is already in place, its duration may be subject to change for various reasons:

  • The duration was manually edited.

  • The assignment is based on employment, and the employment's valid-to date has been set or adjusted to an earlier date.

  • The assignment is tied to an employment, and the associated organizational unit's valid-to date has been set or shortened.

In such cases, the valid-to date of the assignment will be updated to reflect the new valid-to date without requiring any additional actions. If the assignment initially required approval, no new approval process will be triggered, as the revised assignment duration remains within the time frame of the original approval.

Extending an Assigned Assignment

When an assignment is already in place, its duration may be extended for various reasons:

  • The duration was manually edited.

  • The assignment is based on employment, and the employment's valid-to date has been set or adjusted to a later date.

  • The assignment is tied to an employment, and the associated organizational unit's valid-to date has been extended.

In such cases, the valid-to date of the assignment will be updated to reflect the new date. If an approval process is required, it will be triggered again. Since extending the timeframe significantly alters the approved scope, a new approval is necessary.

What Happens to the Assignment

During this process, any existing assignments will transition to the deletion pending state until the approval is processed. However, even though the assignment is in this state, it will not be deprovisioned until the approval is either declined or the original valid-to date has passed.

Deny

Denies are an effective tool while building your role model. There are a few key rules that you should be aware of, when using those.

  • If you have assigned resource A through one role, and you have another role assignment that contains a deny to the resource A, the deny will have higher priority

  • If you have assigned resource A manually and you have role assignment that contains a deny to the resource A, the manual assignment will have higher priority

So to summarize the priorities:

  1. Manual denies

  2. Manual assignments

  3. Automatic denies

  4. Automatic assignments

 

 

© ITSENSE AG. Alle Rechte vorbehalten. ITSENSE und CoreOne sind eingetragene Marken der ITSENSE AG.