Page Comparison

Account Validity

The account Validity recertification policy in EmpowerID collects and presents information about all the accounts owned by a user. Auditors can then review this information and determine whether a user's account is still necessary and should be certified. The responsibility for certifying whether an account should continue to exist or not is usually assigned to a responsible person, such as a manager, responsible party, or other designated individual.

The recertification engine in EmpowerID bundles the recertification items into business requests based on the responsible party assigned to each item. If an item being recertified has no responsible party, it is bundled into one business request based on the Fallback Group By Assignee.

The possible decisions for the business requests generated during the recertification process are typically set as certify, disable, or delete.

Business Role and Location Membership

The business role and location membership recertification policy checks if a user's access to a specific business role and location is still needed for valid business reasons. The responsible person reviews and approves this information via business requests and items.

The engine bundles the recertification items into business requests based on the object itself. Therefore, in this case, the business role and location are the bundles for the business requests, and its members are items.

The possible decisions for the business requests are generally set to certify or revoke the business role and location membership.

Direct Reports

The Direct Reports recertification policy collects access data to validate if the managers and their direct reports are still required for a valid business purpose. The information is presented to the responsible person to certify whether a direct report for a particular manager should exist.

Group Membership

The group membership recertification policy collects access data to validate whether a group membership for a user is still required for a valid business purpose. This information is reviewed and approved by the responsible person who decides whether membership should exist.

The engine bundles the recertification items into business requests based on the object itself. Therefore, in this case, the group is the business requests, and its members are items bundled into the request.

The possible decisions are generally set to certify or revoke the group membership.

Group Owner

The Group Owner membership recertification policy collects access data to validate whether an account as a group owner is still required for a valid business purpose. This information is reviewed and approved by the responsible person during an Audit who certifies whether an account should own a group.

Group Validity

The Group validity recertification policy collects access data to determine whether or not a group is still required. Auditors make a decision about whether a group should exist.

In the case of group validity recertification, the recertification engine bundles the recertification items into business requests as per the responsible party assigned. For any item being recertified where its responsible party is not assigned, it bundles them into one business request as per the fallback assignee.

The possible decisions are generally set to certify, disable or delete.

Management Role Access Assignment

The management role access assignment recertification policy collects data to certify access granted to a management role is still required for a valid business purpose. In other words, the management role access recertification policy is to certify whether an access grant to the management role should exist.

Management Role Membership

The management role membership recertification policy generates recertification data to certify whether a user's membership in a management role is still required for a valid business purpose.

Management Role Validity

The management role membership recertification policy generates recertification data to certify whether a management role is still required for a valid business purpose.

Person Access Summary

The person access summary policy validates the person with all types of access assignments currently granted to a Person. , this policy is to certify if a person should have the access that the person currently possesses.

The person access summary recertifies

• All RBAC assignments, including direct, relative, and by-location assignments

• Direct Business Role and Location assignments

• Any group memberships, including those on their accounts and those granted through RBAC

• Any Management Role memberships

• Account and group ownership

Person Validity

The person validity recertification policy determines whether or not the Person object is still required. In other words, the person validity recertification policy certifies whether a Person object should exist in EmpowerID.

In case of person validity recertification, the recertification engine bundles the recertification items into business requests as per the responsible party assigned. For any item recertified whose responsible party is null, it bundles them into one business request as per the fallback assignee.

The possible decisions for the business requests are generally set as certify, disable, or delete. However, these decisions are configurable.