# Configuring Advanced Provisioning

Use Before Provisioning Rules to customize SAP IAG provisioning beyond source settings. The sections below describe how to set custom fields, configure access request metadata, and manage the leaver process.

## Managing Custom Fields for Provisioning

The SAP IAG connector allows you to set custom attributes using Before Provisioning Rule. For additional information, refer to [FAQs](<https://documentation.sailpoint.com/connectors/sap/cloud_iag/saas/help/faqs.html>).

1. To set custom attributes, use a Before Provisioning Rule and pass an `AttributeRequest` in the plan. Here's an example:

   ```xml
   <AttributeRequest name="CustomAttributes" op="Set">
     <Value>
       <Map>
         <entry key="COUNTRY" value="US"/>
         <entry key="LOCALE" value="en-US"/>
         <entry key="REIMBURSEMENT_CURRENCY" value="USD"/>
         <entry key="REIMBURSEMENT_TYPE" value="CONCUR_PAY"/>
       </Map>
     </Value>
   </AttributeRequest>
   ```
2. To get the names of the custom attributes:

   1. Log in to your IAG tenant.
   2. Go to the **Custom Fields** tile.
   3. The custom fields are listed with their properties. Use the `name` value of the custom field in the plan.

> [!NOTE]
>
> Custom attributes are not required for all access requests.
>
> Take note of the **Custom Field Groups** associated with each custom attribute. This helps determine which custom attributes to include when raising an access request for a specific application.

## Managing Custom Access Requests

The SAP IAG connector allows you to dynamically configure Access Request Priority, Access Request Reason Code, and Access validity dates through a Before Provisioning Rule. For more information, refer to [FAQs](<https://documentation.sailpoint.com/connectors/sap/cloud_iag/saas/help/faqs.html>).

- To set the Access Request Priority use,

  ```xml
  <AttributeRequest name="accessRequestPriority" op="Set" value="5"/>
  ```
- To set the Access Request Reason Code use,

  ```xml
  <AttributeRequest name="accessRequestReasonCode" op="Set" value="CustomRequestReason"/>
  ```

  > **Note**
  >
  > If the Access Request Priority and Access Request Reason Code is not provided in the plan, it will be retrieved from the application configuration.
- To set Validity dates on a role use,

  ```xml
  <AttributeRequest name="Access" op="Add" value="<nativeId of access>">
    <Attributes>
      <Map>
        <entry key="endDate" value="2027-03-10"/>
        <entry key="startDate" value="2025-03-10"/>
      </Map>
    </Attributes>
  </AttributeRequest>
  ```

  If the validity dates are not provided in the plan, the `startDate` will be set to the current date, and the `endDate` will be set to 9999-12-31 by default.

## Managing Leaver Process

SAP does not support the Disable operation for the IAG application, but a delete operation is supported. SailPoint does not show the Delete operation in its UI, therefore a before provisioning rule must be implemented to convert the Disable call from SailPoint to a Delete call.

To perform the delete operation, complete the following:

1. Create lifecycle state with the name "delete".
2. Do no assigne any access profiles to this lifecycle state.
3. Configure a before provisioning rule as in the following example, to map "delete" lifecycle state to the connector's delete operation:

   ```xml
   <?xml version='1.0' encoding='UTF-8'?>
   <!DOCTYPE Rule PUBLIC "sailpoint.dtd" "sailpoint.dtd">
   <Rule language="beanshell" name="Change_disable_to_delete" type="BeforeProvisioning">
     <Description>BP rule for changing disable account request to delete in SAC connector</Description>
     <Source><![CDATA[
       try {
           import sailpoint.object.ProvisioningPlan;
           import sailpoint.object.ProvisioningPlan.Operation;
           import sailpoint.object.Identity;
           import sailpoint.object.ProvisioningPlan.AccountRequest;
           import sailpoint.object.ProvisioningPlan.AccountRequest.Operation;
           import sailpoint.object.ProvisioningPlan.AttributeRequest;

           if (plan != null) {
               log.warn("In IAG BP rule Convert disable to delete");

               Identity identity = plan.getIdentity();
               log.warn("Identity name is: " + identity.getName());
               String lcs = identity.getStringAttribute("cloudLifecycleState");

               String appName = application.getName();
               log.warn("Application name is: " + appName);

               log.warn("Identity lcs value: " + lcs);

               // Get account request
               AccountRequest accountRequest = plan.getAccountRequests().get(0);

               // Change disable request to Delete
               if (lcs.equals("delete")) {
                   accountRequest.setOperation(AccountRequest.Operation.Delete);
               }
           }
       } catch (Exception e) {
           log.error("Error in BP rule: ", e);
       }
     ]]></Source>
   </Rule>
   ```
4. Assign the "delete" lifecycle state to an identity.

   This will delete an account from the SAP IAG application.