"Access denied" error on various operations when using limited account

Question

I am working in Sailpoint IdentityIQ (an enterprise application integration platform) which has a semi-limited account that it uses to provision/deprovision AD Groups to AD Users.

Quite often I will get an "Access is denied" error when trying to perform an operation involving certain users or groups, but I typically do not know WHY I cannot perform the operation.

My questions are:

• For a specific operation that receives this error, is there a way to find out WHY the error occurred?

• For the integration account in question, is there any way to find out all (or even some) of the restrictions that it has on it?

Answer 1

1. For the more detailed information regarding the error, you can enable IQService log, which will print more information regarding the error.
2. For information regarding the permission regarding the service account, you need to reach out to the directory services team.