How to Automatically Remove Manually Assigned Permissions

While permissions assigned by automated rules are removed when the conditions are no longer met, manually assigned permissions often require separate handling. This guide outlines two methods for automatically removing manually assigned permissions: when an employee leaves the organization and when they change departments.

When an employee leaves the organization

You can configure the system to automatically remove all manually assigned permissions when a user's account is deactivated.

This process is handled by a feature called Purge manual roles on delete. When this setting is enabled, all manually granted permissions are removed from a user account as soon as it is registered as deactivated.

To enable this feature please contact Identum support and request to activate Purge manual roles on delete for your organization.

Warning: This feature has a retroactive effect. Once enabled, it will apply to all deactivations.

When an employee changes department

You can also configure the system to automatically remove specific manually assigned permissions when an employee moves to a new department. This requires configuration at both the grouping level and on each specific permission.

Step 1: Enable the setting on the grouping

First, you must activate the master setting for the relevant permission grouping.

1. Navigate to the settings for the specific Grouping (e.g., "Sector for helse og velferd").

2. Under the Information tab, find and enable the option Remove manually assigned department permissions.

Enabling this setting allows individual permissions within the grouping to be automatically removed when a user changes departments.

Step 2: Configure the specific permission

Once the grouping setting is enabled, you must specify which individual permissions it applies to.

1. Within the same Grouping, navigate to the Permissions tab.

2. For each permission that should be automatically removed, check the boxes for:

   • Department-specific permission

   • Remove manually assigned department permissions

Note: This feature is not retroactive. It will only apply to department changes that occur after the configuration is complete, unless the Department-specific permission setting was already enabled.