Hello,
I have configured an Object Policy that needs to be executed only for identities matching specific role assignment criteria.
More concretely, the requirement is to trigger the Object Policy on a pool of identities that have a manually assigned O365 role. However, I am currently unable to correctly filter identities based on the role assignment itself.
Do you know how role assignments can be used as a filtering condition within an Object Policy ?
Thank you.
Hi there,
To trigger an Object Policy based on an identity’s role assignment, you need to define a search expression that explicitly targets role assignments.
This can be achieved by using the hasRoleMatching search function. This function gives you access to all attributes of role assignments, allowing you to use standard search constructs such as <search:And>, <search:Prop> and comparison operators to match your requirements.
In your case, since you want to execute the Object Policy only for identities that:
have a role assigned manually
have an O365 role
your search expression would look like this:
<searchExpression>
<search:Func name="hasRoleMatching">
<search:And>
<search:Prop op="EQUALS" name="source">
<value script="false">MANUAL</value>
</search:Prop>
<search:Prop op="EQUALS" name="role.application">
<value>o365</value>
</search:Prop>
</search:And>
</search:Func>
</searchExpression>
This configuration ensures that the Object Policy is executed only for identities having at least one role assignment that matches these conditions.
If you need more details about search expressions and available search functions, you can refer to the official Memority documentation : Search Expressions
This should address the requirement 🙂
Best regards,
Anouar