Blog

UPDATED RELEASE DATES: Role change Propagation

Author

  • PGookin

    SailPoint

This enhancement is brought to you by Idea AI-I-51

Description

This announcement replaces the original GA announcement for Role Change Propagation.
You can view the previous post here: Original Announcement.

This release introduces a key improvement to ISC Role Management. Now, when access is removed from a Role definition, the corresponding access can also be automatically removed from users assigned to that Role—helping reduce the risk of over-provisioning and keeping access aligned with intended Role design.

With this release, you can now configure ISC to automatically de-provision access from users when it’s removed from the Role they are a member of. Access that is added to a Role definition will continue to be propagated automatically and will operate in the same manner as it does today.

New Capabilities

Role Change Propagation allows you to configure ISC to automatically remove access assignments from users when access rights are removed from their associated Role definitions.

  • A Global Setting is now available to enable/disable the role change propagation feature.
  • The following access changes are now propagated by ISC:
    • Removal of an Entitlement from a Role
    • Removal of an Access Profile from a Role
    • Removal of an entitlement from an Access Profile included in a Role
    • Removal of a Role’s dimension or removing an entitlement or access profile from a
      Role’s dimension.

Problem

Currently in ISC, removing access rights from a Role doesn’t automatically remove that access from users assigned to it—leading to potential over-provisioning and increased risk.

Solution

Role Change Propagation provides the ability to configure ISC so that when access rights are removed from a Role definition, the corresponding access assignments are removed from users who have the Role assigned.

Note: This is an optional capability. A Global Setting is available to enable/disable the Role Change Propagation feature.

When the following access rights are removed from Role’s definition, the corresponding access assignments will be removed from users who have the Role assigned:

  • Removal of an Entitlement from a Role
  • Removal of an Access Profile from a Role
  • Removal of an entitlement from an Access Profile included in a Role
  • Removal of a Role’s dimension or removing an entitlement or access profile from a Role’s dimension.

Who is affected?

Role Change Propagation is available for all customers.

Action Required

Role Change Propagation is a configurable capability which is disabled by default. Customers who opt to use this capability must enable the Role Propagation system feature in ISC Global Settings.

Important Dates

  • Sandbox Rollout: Week of November 17, 2025

UPDATED PRODUCTION ROLLOUT DATES

  • Production Rollout for CA/SE/ME/AP Regions: Week of January 5, 2026
  • Production Rollout for EU/US Regions: Week of January, 15 2026
  • Full General Availability for All Regions: January 23, 2026

To ask questions and learn more please visit the Developer Community.