Access Certification

Specify a name of the access certification campaign.

The name must be unique for each campaign.

Specify a custom header for this column.

Leave this field empty if you want the default From Identity Director header to be displayed.

Specify a custom header for this column.

Leave this field empty if you want the default From Connector header to be displayed. 

Specify a campaign image. This is displayed for your reviewers in the Web Portal.

• You can upload an image from your computer. Supported file types:

  • Images (BMP, GIF, JPG, PNG)

  • Icon files (ICO)

• After the upload, the image can be moved and then cropped to the desired size. The format, however, needs to be square.

This feature is available starting with Identity Director 2022.2.

Select the type of campaign from the drop down list.

Click Add Entitlement to select the entitlement for which you want access to be reviewed.

If a service has the Use as template option enabled, you will not be able to create access campaigns for it. Enabling this option after a campaign was already created for a service will lead to issues in the environment.

Select the campaign owner type from the drop down list.

The campaign owner is a person that, alongside reviewers, receives updates on campaign progress.

• If you select the People option, clicking Add will open a list of people from your environment.

• If you select the Organization option, clicking Add will open a list of organizations from your environment.

Both lists allow you to select multiple people or organizations.

Select the review type from the drop down list.
The Individual reviewers option allows you to pick a single reviewer for your campaign.

The Multiple reviewers option allows you to pick multiple reviewers.

For both Individual reviewers and Multiple reviewers you must manually add people by clicking Add person.

The Smart rule option allows you to select an existing List of people smart rule. You can only pick from the smart rules that have the Used for Access Certification option enabled at Data Model > Smart Rules.

Specify the recurrence of the access certification campaign.

You can only select the one of the following options from the drop down list: OneTime, Weekly, Monthly, Quarterly, Semi-annually, Annually.

For recurring campaigns, the status of each instance is updated independently, while the campaign is shown as Active until the end of its schedule.

To avoid instance overlapping, the value set for the duration must be lower than the maximum number of days allowed by the interval.

Example

Consider the following scenario:

1. Select Weekly from the Specify recurrence of review drop down list.

2. In the Duration (in days) field, input 7.

In this scenario, a warning message is displayed, informing you of the maximum number of days that can be set for the campaign instance duration. Values above the one specified in the message are not valid.

For recurring campaigns, reviewers can be changed between instances, by following the steps below:

1. Set the status of the campaign to On Hold.

2. Remove people from the Reviewer tab.
   Reviewers who still have a campaign instance running will no longer be able to access it in the Web Portal and the instance status will change to Expired.

3. Add new people in the Reviewer tab.
   The new reviewers will be able to access the campaign in the Web Portal starting with the next scheduled instance.

4. Resume the campaign.

Specify the duration of your campaign.

Once you choose a start date using the calendar button, the expiration date is automatically calculated using the duration provided in the Duration (in days) field.

For recurring campaigns, you can select one of the following options from the END drop down list:

• Never

• End on specific date

• End after number of occurrences

Optionally, provide a title that is displayed in email notifications.

If you do not provide it, the campaign name is displayed instead.

Send out emails to notify people about access certification campaign changes. This option notifies all owners and reviewers every time the status of the campaign changes.

Before enabling email notifications, make sure you have enabled E-mail Integration (at Setup > E-mail Integration).

Email notifications are disabled by default.

Send out notifications to managers of reviewers as well.

To notify the appropriate managers, use the Select a Smart Rule to determine the managers drop down list.

Send out notification to additional people that need to be informed about the campaign.
Click Add person to select people from your environment.

Specify a custom message for the email notification.

Display an additional field in the Web Portal, where reviewers can motivate their choice.

By default, this option is disabled and the field is not displayed in the Web Portal.

If you select Optional, reviewers are free to decide if they want to provide an explanation for their decision or not.

If you select Mandatory, reviewers must provide an explanation to support their decision.

Send out additional reminders to your reviewers.

The first option can be customized to send out notifications to reviewers if they have not started the review after the specified number of days from the campaign start.

The second option can be customized to send out notifications to reviewers if they have not started the review and there is a specified number of remaining days for the campaign.

The messages for both options can be customized and, optionally, sent out to the managers of the reviewers as well.

Click to export the data available in this tab to CSV. The file will contain the following columns:

• Reviewer Name

• Items Reviewed

• out of

• Status

• Qualified People

This is the language set as default at Setup > Translation.
Click to export the RESX of the default language and use it as the basis for translations for the other supported languages.

List of other languages that have been enabled at Setup > Translations.

• Each supported language uses the default language if you do not upload a RESX file.
• Click to reapply the default language.
• Click to export the RESX of the language to make adjustments to the translation.
• Click to import the RESX of the language. This ensures that custom labels are translated in the correct language.

Enable the Add data connections for entitlement reconciliation option to import information about Security Groups and Organizational Units to perform an Access Reviews reconciliation.

Click Add data connection to select one or more People and Classifications data connections from your environment.
People data connections should use an Active Directory Data Source of type People, while the Classifications data connections should use an Active Directory Data Source of type Group Membership.

For Classifications connections, people's names are extracted from their people identifier.

Click Insert OR to trigger intersection or union operations between data connections. In this context, you can use the same data connection more than once, without having duplicates listed in the Web Portal for the campaign reviewers.

All connections are processed at the same time. If any of them fails, they all fail. The error is logged into the trace file (if enabled) and no information is imported for reconciliation.

The Reconciliation status displays the progress and the duration of the current reconciliation process.

View the qualified people and their corresponding state.