create time/ period (days) based access in servicenow for users and groups provisioned from Entra id

[RonaldT]

Users and groups get created/provisioned in ServiceNow via Microsoft Entra ID, we want them to have access for X number of days and then get removed from groups which they were added by Entra.

is this possible or any other suggestions .

[Mrudula6]

Hello @RonaldT ,

 Assuming your "x" number of days is fixed for eg, 10 days. You can do this using a simple scheduled job which runs daily and checks

1. Query the group membership table (sys_user_grmember)

2. Query the records created by Entra ID integration user and created Date is 10 days prior than current date.

3. Delete the records from group membership table. 

This would remove the membership for the users after X number of days, but keep the users and groups from Entra ID as intact.

Thank you,

Mrudula

[Kieran3]

Hi @Mrudula6,

The key issue here is if you delete the user in ServiceNow, it will be reprovisioned by Entra ID because they are still a valid user.

Hope this helps! If you found it useful, feel free to leave a 👍 Kudos. If it answered your question, accepting it as a solution helps others find the answer too.

[RonaldT]

yes, you are right ,,,they will get reprovisioned by Entra ID because they are still a valid user.

[RonaldT]

Thank you Mrudula, for your response,  they would get readded when the Sync from Entra happens.