In what order should aggregation be performed for accounts and entitlements?

• A. Entitlements, then accounts
• B. Accounts, then entitlements
• C. Simultaneous aggregation
• D. Based on importance

Answer: (B)

Aggregating accounts before entitlements is the preferred approach because it ensures that the identity governance system has a complete and accurate view of user identities before examining their respective entitlements. When accounts are aggregated first, it allows the system to create a comprehensive inventory of all user accounts across various systems. Only after this foundational data is established should the entitlements be aggregated, as entitlements are associated with those accounts.

This order is crucial in identity management because entitlements often depend on the underlying accounts they are mapped to. By prioritizing accounts, the process ensures that any resulting entitlement data reflects the current and relevant context of user accounts, thereby enhancing the accuracy of access reviews, compliance reporting, and risk assessments.

In contrast, aggregating entitlements first could lead to confusion or inaccuracies, as this information might not be linked to the correct accounts, making it difficult to ascertain who has access to what. Hence, the logical flow of gathering accounts first lays the groundwork for effective entitlement management and governance.