Access Review Campaign Settings

Enable Campaign Readiness

No - Applications have been synced recently and the campaign can start immediately

When this option is disabled, then Get Ready tab will not be available.

When this option is Enabled, set it to “Yes - Before the campaign starts, assign tasks to update application data and track data quality”, Get Ready Tab is visible and apps added in the campaign are listed with readiness steps.

Allow Requesting Permission Change

No - Reviewers can only Maintain or Revoke permissions

When this option is disabled, the change permission action on the review items is not available.

When this setting is enabled, the change permission to other permission action is available. Note there is a bug with this feature when a non-admin is trying to change a permission

Allow Bulk Resolving of Permissions

Yes - Allow reviewers to resolve multiple permissions at once (Maintain/Revoke)

When this option is disabled, reviewer has to take actions on individual item, bulk actions can not be taken.

When this option is enabled, the Bulk actions can be taken on review items.(e.g.maintain/revoke/change)

Allow Reviewers to Reassign Access Review Items

Yes - Allow reviewers to reassign review items

When this option disabled, set to “No - Do not allow reassignment by reviewers” then the reviewers can not reassign the review items, the reassign options are not present UI(except Admin and Monitor can reassign the review items even if the settings is disabled)

When this option is enabled, the admin, monitors and reviewers can reassign the review items to other users/reviewers.

Allow Incomplete Reviews to be Submitted

No - Each item in the review must be completed (marked as Maintain/Revoke)

When this option is disabled, set to No then each and every review item from the review task should be completed then only the review task submission is allowed .and user can still complete the campaign by saving the task.(The submit task button is enabled only all review items are completed).

When this option is enabled, the review tasks can be submitted even if the reviewer has not completed the review items(by taking actions on the items)Submit button is still enabled.

Revoke Unreviewed Permissions

No

This setting will only appear if enabled in your tenant. Please contact Customer Support for assistance.

When this option is disabled, review items that are not yet completed with a resolution action when the campaign is closed will remain unresolved.

When this option is enabled, all review items that are not yet completed with a resolution action when the campaign is closed (whether or not they are in submitted tasks) will be automatically marked as revoked.

Limit Review to Privileged Permissions

No limit

When this option is set to “No limit", then all the permissions(privileged/non privileged) will be part of the campaign.

When the option is set to “Only privileged permissions“ ,then only privileged permissions will be the part of campaign.

When the option is set to “Only non-privileged permissions“ , then only non-privileged permissions will be the part of campaign.

Limit Review to External Users

No - Include accounts with any domain

When this option is disabled, then the accounts with any domain will be part of the campaign(accounts that are mapped to external domain users will also be part of the campaign)

When this option is enabled set to “Yes - Include only accounts that have an external email domain“ then only accounts that have external domain emails(external to the organization domain) will be part of the campaign.

Revoke Accounts of Inactive Users

No - Do not automatically mark inactive user accounts as revoked

When this option is disabled set to “No", then the accounts mapped to inactive users, permissions of those accounts will not be automatically marked as revoked.

When this option is enabled set to “Yes - Mark all inactive user accounts as revoked", then the accounts mapped to inactive users, permissions of those accounts will be automatically marked as revoked.

Allow Self Review

Yes - Allow self review

When this option is set to “Yes - Allow self review “then the reviewer can review his/her own permissions.

When this option is set to “No - Reassign self reviews to the application Technical Owner “then the reviewer 's own permissions are assigned to the application technical owner if present ,otherwise assigned to the campaign monitor if present, otherwise unassigned.

When this option is set to “No - Reassign self reviews to the Monitor “then the reviewer 's own permissions are assigned to the campaign monitor if present, otherwise assigned to the Application technical owner if present, otherwise unassigned.

Require Comments

No

When this option is set to “No “then the addition of comments on the actions taken on the review items is not mandatory

When this option is set to “Yes - Require comments on Maintain actions “then the addition of comments on the maintain action taken on the review items is mandatory

When this option is set to “Yes - Require comments on Revoke actions “then the addition of comments, on the revoke action taken on the review items is mandatory

When this setting is set to “Yes - Require comments on all actions “then the addition of comments, on the maintain/revoke action taken on the review items is mandatory

Require Comments on Flagged Items / Violations

Yes - Require comments on Maintain actions for flagged items / violations

When this option is disabled and set to “No” then the addition of comments is not mandatory while maintaining the sod violated/flagged review items.

when this option is set to “Yes - Require comments on Maintain actions for flagged items / violations“ then the addition of comments is mandatory while maintaining the sod violated/flagged review items.

Limit Review to Unreviewed Permissions

No - Include all previously reviewed permissions

When this option is disabled then all review items/permissions will be part of the campaign. whether those are part of previous campaigns or not.

When this option is enabled set to “Yes - Limit to permissions not reviewed within the last X days", then only review items/permissions, those are not reviewed within last X days, will be part of the campaign. for example, permissions that are not reviewed within last 90 days.

Limit Review to Privileged Accounts

No limit

When this option is set to “No limit”, review items will be included regardless of whether the account is privileged.

When this option is set to “Only privileged accounts”, the campaign will include only accounts that are privileged (that is, contain a privileged permission).

When this option is set to “Only non-privileged accounts”, the campaign will include only accounts that are non privileged (do not contain a privileged permission).

Limit Review by Account Types

No - Review permissions of all account types

When this option is disabled then review items of all types of accounts will be part of the campaign. for example, User, Guest, Bot,Service

When this setting is set to “Yes - Limit review to account types:“ then review items of given account types only, will be part of the campaign. we can provide comma-separated account type values.

Generate Review Based on Pre-defined Business Roles

No

When this option is set to No then irrespective of business roles all permissions from the selected apps will be the part of campaign.

When this option is set to “Yes - Only review permissions that are exceptions to pre-defined business roles” the permissions matching to the pre-defined business roles are excluded from the review and the permissions not matching to business roles will be part of the review.

When this option is set to “Yes - Permissions matching pre-defined business roles are assigned to the application business owner” then the matching pre-defined roles will be assigned to the business owner and pre-marked as maintained.

Assign Review to Designated Reviewer

No

When this option is set to No then review items will not be assigned to Designated reviewer. Review items will be assigned to supervisor if the campaign is Supervisory campaign and application owner if the campaign is an application owner campaign.(if supervisor and app owners are not present then review items will be unassigned.)

When this option is set to “Yes - Items will be assigned to the user's designated reviewer “then the items will be assignee the designated reviewer.

Assign Review to Delegate

No

When this option is set to No then review tasks will not be assigned to reviewer’s delegate. Review items will be assigned to supervisor if the campaign is Supervisory campaign and application owner if the campaign is an application owner campaign.(if supervisor and app owners are not present then review items will be unassigned.)

When this option is set to “Yes - Items will be assigned to the reviewer's delegate” the review task will be assigned to the reviewer’s delegate user.

Assign Review to Resource Owner

No

When this option is set to No then review items will not be assigned to Resource owners. Review items will be assigned to the supervisor if the campaign is Supervisory campaign and application owner if the campaign is application owner campaign.(if supervisor and app owners are not present then review items will be unassigned.)

When this option is set to “Yes - Reviews of resource permissions will be assigned to the resource owner “the resource permissions will be assigned to resource owner if available. Otherwise remained unassigned.

Assign Review to Permission Owner

No

When this option is set to No then review items will not be assigned to Permission owner. Review items will be assigned to supervisor if the campaign is Supervisory campaign and application owner if the campaign is an application owner campaign.(if supervisor and app owners are not present then review items will be unassigned.)

When this option is set to “Yes - Reviews of permissions with owners will be assigned to the permission owner” the review items(permissions having owners) will be assigned to permissions owner if available. Otherwise remained unassigned.

Move Review Items Assigned to Inactive/Deleted Users to Unassigned

Yes - Move to Unassigned - to be reassigned by the campaign monitor

When this option is set to “Yes - Move to Unassigned - to be reassigned by the campaign monitor”, review items that would be assigned to inactive/deleted users will instead become unassigned.

When this option is set to “No”, these items will remain assigned to the inactive/deleted users.

Assign Review When Supervisor is Unknown

Automatically assign review to the application business owner

This option only exists for supervisory reviews.

When this option is set to “Automatically assign review to the application business owner”, review items with no reviewer will be assigned to the application business owner.

When this option is set to “Leave as Unassigned - to be reassigned by the campaign monitor”, these review items will remain Unassigned.

Allow Shared Owner Reviews

No - Reviews of permissions are assigned to a single reviewer

When this option is set to No then review items will be assigned to the single reviewer.

When this setting is set to “Yes - Reviews of permissions can be assigned and shared among multiple reviewers” then in case of

• Application owner campaign :

the review tasks are shared among the application’s Business owner and the Additional owners assigned to the app and permissions owners if assigned to the permissions of the app involved in the campaign

• for the Supervisory campaign :

The review tasks will be assigned to the reviewers and the permissions owners assigned to the permissions of the apps involved in the campaign.

Move Review Items Assigned to Inactive/Deleted Users to Unassigned

This setting has highest precedence, but currently only applies at campaign population time.

Assign Review when Supervisor is Unknown

This setting exists only for supervisory reviews, and if it is set to assign to app business owner, it will have higher precedence than the settings below.

(If both this and “Move Review Items Assigned to Inactive/Deleted Users to Unassigned” are set, items assigned to inactive/deleted users will go to the app business owner--unless the app business owner is inactive/deleted, in which case the item will be unassigned.)

Assign Review to Delegate

This setting has lower precedence than “Move Review Items Assigned to Inactive/Deleted Users to Unassigned”

Assign Review to Permission Owner

This setting has lower precedence than the “Assign Review to Delegate“

Assign Review to Resource Owner

This setting has lower precedence than the “Assign Review to Permission Owner“

Assign Review to Designated Reviewer

This setting has lower precedence than the “Assign Review to Resource Owner”

If we have the review setting enabled, permission owner setting enabled

The Permission Owner setting takes higher precedence

If we have the self-review setting enabled, permission owner setting enabled and resource owner setting enabled

The Permission Owner setting takes higher precedence.

The Resource owner takes precedence over the self review setting.

if we have the self-review setting enabled, delegate review setting enabled.

The delegate review setting takes higher precedence.

if we have the self-review setting enabled, delegate review setting enabled and designated reviewer setting enabled

The delegate review setting takes higher precedence.

The Designated reviewer setting takes precedence over the self-review setting.