The provisioning policy in IdentityNow natively supports a ‘Delete After Days’ setting. When configured on a disable action, it will automatically delete the account after the specified number of days, perfectly meeting the requirement without needing custom workflows or complex configurations.

The Provisioning Diagnostics area in IdentityNow has a ‘Pending’ tab that shows provisioning events that have been submitted to the connector but have not yet completed or failed. This is the primary tool for troubleshooting delays or failures in the account creation process after roles have been assigned.

Certification campaigns in IdentityNow are source-specific or attribute-based. The cleanest and most maintainable approach is to create a separate campaign scoped to the AWS source with a quarterly schedule. This keeps the policy enforcement clear and doesn’t interfere with the existing monthly review of other privileged accounts.

The System Logs, specifically filtered for ‘Provisioning Audit’ events, contain a granular, timestamped record of every provisioning transaction processed by IdentityNow. This includes the target, action (enable, disable, modify, delete), attributes changed, and the result, providing the definitive audit trail for access changes.

Access Profiles are the core component for bundling entitlements (permissions/accounts) from a source. They can be dynamically scoped using Identity Attribute Constraints, which evaluate against identity attributes (like ‘location’) at the time of assignment to determine if the profile should be granted.

For self-service password reset to work for a non-authoritative source like a legacy application, the Password Sync feature must be explicitly enabled on that source’s configuration. This allows IdentityNow to accept a password change from the UI and propagate it to the target system via the connector.

When data in IdentityNow doesn’t match the expected authoritative source, the first place to check is the source’s attribute mappings and any transforms applied during aggregation. An incorrect transform or mapping could be pulling data from the wrong field or applying faulty logic, leading to the wrong value being populated in the identity attribute.

IdentityNow’s Time-Bound Access feature allows an approver (or through policy) to set a specific duration or end date for an access assignment when approving a request. This is the native, automated way to grant temporary access that revokes itself without manual intervention.

Role Assignment Policies automatically grant or revoke roles based on identity attributes. By creating a policy that grants ‘Sales_National’ to the ‘West’ region (and potentially revoking ‘Sales_West’), and then triggering a role calculation (from the Roles menu), IdentityNow will automatically reassign roles for all affected identities in bulk.

The provisioning policy in IdentityNow natively supports a ‘Delete After Days’ setting. When configured on a disable action, it will automatically delete the account after the specified number of days, perfectly meeting the requirement without needing custom workflows or complex configurations.0