...
This document provides instructions on how to define and create an access reviewAccess Review. This function can be done by admin users.
...
To create a new campaign, click Create Campaign on the Access Reviews tab page that lists all the current and completed Access Review Campaigns.
...
A new campaign will be created. User will land on
About Campaigntab of the campaign.
...
Selecting users, applications and permissions
A Campaign monitor can filter the list of users to be included in the access review. By default all directory users are included. A warning icon flags users without a defined manager.
...
...
You can filter users by Department, User Status (active/inactive/deleted), Tags, or Last Transfer Date. This last option allows you to select users who moved positions in the previous week (Sunday to Saturday), the calendar month preceding the current month, or the 3-month period preceding the current month.
...
Select the applications to be reviewed. You can filter the list to specific departments or regulations. A warning icon indicates applications that do not have any data or have out of date data. Use the Get Ready feature to collaborate with your company to update your data for your campaign.
...
You can limit the review to specific permissions, or you can exclude certain permissions from the review. Enter the permissions you want to include or exclude in the appropriate field; if you want to include/exclude multiple permissions you can specify a list separated by commas. The text is case-insensitive but needs to match the whole name of the permission. You can use an asterisk * as a wildcard: for example, “admin*” will match “Administrator”; “*reader* will match any phrase with “reader” or “Reader” in it. “default” matches Zilla’s default permission for users with no explicitly set permissions.
...
Limiting permission types in the review
You can also limit the review to certain types of permission, as listed in the “Permission Type” column in the review: e.g. “Role”, “Group”, a plain “Permission”, etc. You do this with the keyword “@type:” in either the include or the exclude column.
Here, “@type: group” in the Include column would include only permissions of type “Group” for the specific application, and “@type: permission, @type: role” in the Exclude column would include all permissions that are not of type “Role” or type “Permission”.
The match is case-insensitive, but wildcards are not allowed for types, and the name must match the entire type. Whitespace after the prefix “@type:” is optional.
...
Customizing campaign settings
Campaign settings are across three tabs ‘What to Review’, 'Who Reviews”, and “Campaign Options”.
What to Review tab
...
Who Reviews tab
...
Campaign Options tab
...
To customize your campaign for your specific requirements,
...
click
Editin Campaign Settings section.
...
...
Edit in “What to Review” tab
...
Edit in “Who Reviews” tab
Edit in “Campaign Options” tab
Note:
In “Campaign Options” tab, for “Allow Requesting Permission Change”, If you select “Yes - Reviewers get an additional option to request a Change to the existing permission” for “Allow Requesting Permission Change” , any review marked as Change will be tracked on the Report tab as a Revoke.
...
You can customize the message sent out to reviewers when the campaign is launched. The campaign can be programmed to automatically send out email notifications to reviewers whose reviews are overdue, or to escalate them to the reviewer’s manager. To enable and control these features, click the Edit link for Email Notifications.
...
...
The custom message at the top will be incorporated into notifications sent to reviewers when the campaign launches, letting them know they have a review to do. The campaign can also send automated reminders some number of days after the campaign starts or some number of days before it is due to end. (Note that in the second case, if the campaign’s end date is less than this number of days in the future, the reminders will go out immediately!)
...
Finally, it is possible to specify that all campaign monitors will receive copies of all campaign notifications. You can also limit these notifications to the case where a review item becomes (or is created as) unassigned to a reviewer.
Navigate to the preview Preview Campaign tab to preview the campaign before it is run.
...