Skip to main content

HelloID

Troubleshoot entitlement actions

If an entitlement action does not have the expected result when running an Enforcement, the following sequence will help you troubleshoot it.

  1. Check the action history: View action history. Locate the action in question, and View entitlement details to see its logs. If the action failed, for example, due to an invalid target mapping or a bug in your PowerShell code, the specific error message can be found here.

    If you can find and fix the error, proceed to step 5.

  2. Check if the action is pending: View running & pending actions.

    If the action cannot be found in the entitlement action history, it may not have failed; it may still be in progress. This most often happens when an entitlement action is waiting on a dependency. For example, an Account entitlement will not be revoked until all Account Access and Permission entitlements for that account have been successfully revoked (see Dependency order). Similarly, if a target system uses data from another system (as configured on the Account tab of the target system), it will wait upon the other system.

    • An action can be waiting indefinitely if there is a problem with the action it is waiting for. Hover over the action’s Waiting status to identify the action that is being waited for. Then troubleshoot that specific entitlement action for that specific target system (start over with step 1).

    • If all actions are Waiting, this may indicate that no business rule grants the entitlement the actions are waiting for.

  3. Check the business rules.

    Is the person in scope of a business rule that grants or revokes the entitlement? To find business rules that grant or revoke the entitlement in question, View a target system's entitlements.

    You may need to edit your Business rules or Conditions.

    Alternatively you may need to correct the person’s data in the source system, so that next time HelloID runs, the person is in scope of a business rule that grants or revokes the entitlement. You can then either wait until the business rules are applied again automatically or Run a manual import and proceed to step 5.

    Finally, check whether the person is included in the business rules. If they are excluded but should be included, Re-include a person.

  4. Check the target system.

    • Is it running? If applicable: is the Agent running?

    • Are there any error messages?

      If the target is executed via the on-premise HelloID agent, then the log files of the HelloID service on your agent server will provide more information.

      If the target is an Active Directory system, see Troubleshoot an AD target system.

    • Is the target system enabled in HelloID? See Enable a target system.

    • Was the correct account correlated to this person? You may also need to check the person's (correlation field) data in the source system. See Correct a wrongly correlated account for instructions on how to correct a wrongly correlated account.

  5. Perform a new Enforcement.

    If an error affected multiple entitlements, you may need to perform a full enforcement (see Run an enforcement).

    If it only affected a small number of entitlements, you can individually Retry failed action for the failed entitlements, without performing a full enforcement.

    Note

    Any previously granted entitlements (such as account access, groups or dependent accounts) may need to be manually retried.

    Once an entitlement is granted, any pending actions that depend on that entitlement will be performed automatically.

  6. Check whether the issue has been solved.

    Check the action history again: View action history, check the person's state in HelloID: View a person's entitlements or View all granted entitlements, and verify that it aligns with the state in the target system.

You are welcome to contact Support if:

  • An error in the action history is unclear or you are unable to fix it.

    Please copy the Support information (e.g. labels.CorrelationId:"400fbb8d-81c9-4a34-a79d-134f01f26560.b2986e42-4fac-4dcd-89e9-36e6523454b0") from the action history and paste it into your support request.

    History_SupportInformation.png

  • An action has been listed as 'Running' for more than 24 hours.

  • At the end of this troubleshooting procedure you have not found the issue or have not been able to solve it.

Correct a wrongly correlated account

An account in a target system may sometimes get correlated to the wrong person in HelloID. For example:

Scenario 1: One person is correlated to the wrong account due to an incorrect correlation property of either the person in the source system or the account in the target system.

Scenario 2: Two persons are correlated to each other's account, due to incorrect correlation properties of either the persons or the accounts.

Scenario 3: Due to a change in employee ID, there are two persons in HelloID who are actually the same employee. The existing account is correlated to the 'old' person in HelloID, who is included in the business rules. The 'new' person needs to get correlated to the existing account.

Tip

To get clarity on current correlations you could generate a correlation report for your target system (Generate report for Active Directory, or Generate report for Azure AD).

To correct a wrongly correlated account:

  1. In HelloID, unmanage the wrongly correlated account or accounts.

  2. Fix the underlying problem: update the correlation property of the person(s) in the source system and/or of the affected account(s) in the target system.

    In case there are two persons in HelloID who are actually the same employee, exclude the 'old' person or Manually merge persons. Make sure the 'new' person is included in the Business Rules.

  3. Wait until the Business Rules get applied, or perform a new Enforcement.

In this section: