We are working on the MyMFA / My-Keys Premium enrollment lifecycle (Browser and Mobile App) and have two questions about the PIN.

Context

The PIN is set by the user at first enrollment. When a user removes their last MFA enrollment (Browser or Mobile App), their MyMFA / My-Keys Premium account appears to remain active. Our goal is for the user to be able to define a new PIN at their next enrollment.

Question 1: Resetting the MyMFA / My-Keys Premium account

Is there a widget or a function callable from Groovy that resets the user's MyMFA / My-Keys Premium account? Calling it when the last enrollment is removed would let the user define a new PIN at the next enrollment. If such a function exists, could you point us to the documentation or to a configuration example?

Question 2: Triggering on removal of the last enrollment

We would like to set up a policy that triggers in the following situation:

• The user no longer has any Browser or Mobile App MFA enrollment, but their MyMFA / My-Keys Premium account is still active.

• The user has just removed their last Browser or Mobile App MFA enrollment.

Is it possible to access or define such a trigger? For example, can an Object Policy or a Business Policy be scoped on the removal of an enrollment, and which object, event or attribute should it target (MyMFA account, identity, audit event)?

Additional information

• Which policy type and stage would you recommend for this use case?

• If a native mechanism already handles PIN reset when the last enrollment is removed, we would be glad to know about it.

Thank you in advance for your help.

I am currently looking at what is the best technical solution to manage grace periods in role assignments.

My use case is the following :

1. An internal user gets the "Active Directory" role, when he is at the status NORMAL

   • The role is assigned thanks to a Role Assignment Policy scoping internal users with status==NORMAL.

2. At currentDate >= activationUntil, his status is set to RETIRED and enabled = false

3. I want the user to keep the role until activationUntil + 1 day

What is the standard solution to manage Role Assignments grace periods ?

Regards,

Logan

When a reference table entry used as a dimension value on a right is deleted, the role assignments referencing it retain only the raw ID — the value can no longer be resolved.

A few questions:

1. Is this the expected behavior? Is there a native mechanism to handle this case?

2. What is the recommended way to fix orphaned values in bulk?

3. Is it possible to configure a fallback/default value on a right dimension for such cases?

I want to retrieve the information that an account is blocked after several missed attempts on the authentication page.

I am not sure that it is possible since it is an AM information ?

Regards

I would like to customize the image displayed when loading a Memority page

• either by adding a client logo or removing it entirely.

In my opinion, this is not currently possible.

Regards,

I want to configure an Internalization and an Externalization process within an import connector and don't know how.

The situation is the following:

• The tenant receive all identities (internal and external) from the same source

• The source sends the identity type associated with each identity

• If I detect a type change:

  • External --> Internal = transformation of the existing external identity into an internal one ("migration" from external type to internal type, transformation of email address + retention of the previous one as an alias, preservation of access rights, provisioned accounts, mailbox, audit trail, enrolled authentication devices, ...)

  • Internal --> External = deactivation of the internal identity + creation of a new external identity

• Identities retain their "source ID" when a type change occurs (so correlation is easy to do)

I would like to know if you have examples and/or best practices of configuration to perform these processes. Basically, I need to find a technique so that:

• Same ID and same employee type → I correlate

• Same ID and employee type changes from EXT to INT → I correlate and transform the identity

• Same ID and employee type changes from INT to EXT → I do not correlate, so I have one identity that disappears and one that appears

Thank you in advance for your help.

Is it possible to conditionally display role dimensions during the request-with-approval process?

Functional use case:

If Requester:

Do not display

If Approver:

Display dimension

Regards,

Hassan

The assignment of a role to an identity has not been removed, even though it no longer meets the criteria of the role assignment policy.

What explains that?

Regards,

Hassan

Our customer showed us that the same scope does not behave equally between stage and production environments.

The scope is a meant to be a list of organization IDs.

• Production returns a string: "AA0000, BB1234, CC4567"

• Stage returns a list: ["AA0000", "BB1234", "CC4567"]

All configurations seem to be identical:

• The corresponding attribute in MemorityReporting is a list on both environments (in both "application" files, the attribute is multivalued)

• The corresponding attribute (iamUserCustomMulti...) in MemorityAuthentication is a list on both environments (in both "application" files, the attribute is multivalued)

• The access attributes are configured equally (multivalued, same index)

• Both federations are configured equally (same scope points to same attribute)

• All referenced objects still exist

What could be the issue?

I am creating WS Features / API to allow my client to read information in Memority.

My client needs general APIs as well as scoped APIs.

Examples:

• General API = reading ALL companies declared on my tenant

• Scoped APIs = reading all companies LINKED to my portal (resource)

• Scoped APIs = reading all users WITH ACCESS to my portal (resource)

For scoped APIs, I basically want to reproduce what you get when navigating an object cockpit (e.g. : /features/resource-extranet-hub/%ID%/resource-extranet-companies)

EXAMPLE 1 : companies linked to my "Orange" portal are displayed

EXAMPLE 2 : users with access to my portal

How can I do this?