Provisioning

Currently we support a smaller set of business rules and we want to increase this limit to 5000 Business rules. This feature will not change the current UI but we will just support 5000 Business rules. In a later stage we will improve the user interface and make new way's to create business rules available. It could be this feature will results in multiple other limits to be set or increased. When we know these limitations we will report it in this feature and when released on docs.helloid.com or in the software.

As an admin, I would like to create several sets of entitlements which can be assigned to different rules. For example with Topdesk. When creating an operator account, we want to have several other entitlements included as well. Only one or two entitlements (the operator group for example) will differ between different rules, while 5 other entitlements will be the same between the rules. When I'm able to create a set, I'm able to assign this set to the different rules, having these entitlements aligned between different rules. This will prevent missing an entitlement (or setting the wrong one) while creating many 'almost the same' rules. It would be nice to be able to adjust this set after creation and assigning as well, updating the entitlements in the different rules. However, a 'shortcut' adding those entitlements with only one click would already be an improvement.

Currently, provisioning errors in HelloID Provisioning are only reported to the HelloID administrator after a snapshot run with a very basic email without much context. In environments with multiple target systems, the HelloID administrator is often not responsible for resolving these application-specific issues. It would be valuable to allow error notifications to be configured per target system, for example by sending emails directly to the responsible functional administrators or automatically creating a TOPdesk ticket for the appropriate operator group. This would reduce manual follow-up, improve ownership, and ensure provisioning issues are resolved faster.

I'd like the ability to create a condition in Business Rules that allows a rule to be applied only when another Business Rule has already been applied to the same person. For example, some HR systems contain external users or interns who do not always require an account. In these cases, I can create a Business Rule for account provisioning that excludes external users. I can then create a separate Business Rule for exceptions, allowing specific external users who do require an account to be added manually. The challenge arises when I create a rule such as "Enable Accounts". This rule attempts to run for all users, including those who will never receive an account. As a result, many users appear in Actions with a status of "Waiting". To avoid this, I would need to create separate Business Rules for enabling accounts, assigning default rights, granting additional entitlements, and so on. This quickly increases the number of rules that need to be maintained. It also increases administrative complexity because any changes must be replicated across multiple Business Rules. By allowing a Business Rule to check whether a user has already been included in, or granted access through, another Business Rule, administrators could significantly reduce the number of required rules and the associated maintenance effort. This would simplify rule management, reduce administrative overhead, and prevent unnecessary pending actions for users who are not intended to receive accounts.

Can we get an export to csv button for the persons in scope of a business rule? Its something we like using when going live or changing certain business rules to make comparisons

In AFAS, a manager can delegate tasks in case of illness or absence. This is automatically switched on and off (for example, when someone reports sick). This information is also available in the connector to HelloID. It would be great if this information could be used to activate and deactivate delegation within HelloID as well, so that the employee only has to set it up once.

I'd like to give this item some attention again, because this issue keeps growing for our costumers. Time based product assignments currently send out emails x time before the assignment is being returned. This causes a bit of panic and frustration for end users that need this product for their work, only to find out they cant extend it. I've also spoken to multiple functional application administrators at different costumers that have a hard time convincing management that extending a product is not possible in 2026. This hurts the adoption of the entire service automation module. What we'd like is an option to extend the assignment, which when pressed gives you the option to select a new expiry date/time when dynamic, or when fixed shows you 'extending product to {date/time}'. When pressing confirm it executes the approval workflow assigned to the product. If the product is extended no additional actions have to be executed, only the return date of the product should change.

The current Reconciliation report is not really a report, but more of an issues/incidents list. The important stakeholders in the governance process don't use this information, the want reports showing mismatch percentages, percentages of unmanaged permissions, trends, counts. They want to see that month over month improvements are being made to reduce the amount of unmanaged permissions, they want to see their governed entitlements increasing. These reports are especially essential when you think about NIS2 and GDPR, they state that the responsibility of cybersecurity is placed at the organizations governing body, which means that we should be able to report to them with our Identity and Access Management governance status etc. The solution is currently build solely for IT, which is exactly what NIS2 is trying not to do.

For example, if you select department and title, rule mining will only give you suggestions for 1 department, 1 title, of 1 of both. It will never show you rules that for example are scoped by 5 departments. The fact that role mining does not do this makes the report lose a lot of its values, for bigger organizations (lets say more than 800 employees) i dont see a lot of value in the report without this.

We want an overview where we can see the hierarchy of the organization based on the imported departments. For each department i'd like to see who is the manager, which other properties we can find within that department, for example which titles are linked to that department (with counts of within department/total in organization). This could be done for all properties of the contract. This would give organizations a clear overview of how their organization is represented in data for HelloID, and would help with scoping business rules, understanding business rules etc.