Page Comparison

Recertification policies contain procedures for ensuring that users affirm that they have a genuine, continuous need for a particular resource or membership. The recertification policy also defines the frequency with which users must validate their requirement for a resource or membership.

EmpowerID recertification policies have the following types.

...

Recertification Policy Type

...

Description

...

Account Validity

Account validity recertification is a method of determining whether or not accounts are still required. Certain actions must be made if the accounts are no longer required. In other words, an account validity recertification policy to certify whether an account should exist or not.

...

EmpowerID provides various policy types for recertification audits that determine the type of access recertification to be performed. The policy outlines the information to be evaluated regarding individuals' rights and access rights. During the recertification process, EmpowerID generates business requests that ask auditors to recertify the access. Each access is a business request item that needs to be certified, and the way the items are bundled into a single request depends on the policy type.

Info

Key Information

The responsible party and Fallback Assigne are important persons in access recertification. A responsible party is an individual who is responsible for managing and maintaining IT resources. The responsible party can be configured according to the instructions provided here. On the other hand, the Fallback Group By Assignee is specified when an audit is created and serves as the default assignee for recertification requests for that specific audit.
You can configure additional decisions if default decisions provided in EmpowerID are inadequate, and you want more options. More information is provided in Configure Custom Decision for Business Requests.

Type	Purpose	Business Requests & Decesions
Account Validity	The account Validity recertification policy in EmpowerID collects and presents information about all the accounts owned by a user. Auditors can then review this information and determine whether a user's account is still necessary and should be certified. The responsibility for certifying whether an account should continue to exist or not is usually assigned to a responsible person, such as a manager, responsible party, or other designated

person) checks the user's account and decides whether this account should continue to exist.

For the recertification, a recertification policy is created, a recertification audit is created, and the recertification policy is added to the audit. The audit is compiled, which generates business requests that are sent for approval.

In the case of account validity recertification, the recertification engine

individual.

The recertification engine in EmpowerID bundles the recertification items into business requests

as per

based on the responsible party assigned

. For any

to each item. If an item being recertified

where its

has no responsible party

is null

, it

bundles them

is bundled into one business request

as per the fall-back assignee

based on the Fallback Group By Assignee.

The possible decisions for the business requests generated during the recertification process are

generally

typically set as certify, disable, or delete.

However, these decisions are configucreatingre details on how to create an account validity recertification policy, visit the account validity recertification page.


Business Role and Location Membership	The business role and location membership recertification

process validates whether the membership of a

policy checks if a user's access to a specific business role and location is still

required

needed for

a

valid business

purpose. Certain actions must be made if membership is no longer required. In other words, the business role and location membership recertification policy is to certify whether membership should exist.For the recertification, a recertification policy is created, a recertification audit is created, and the recertification policy is added to the audit. The audit is compiled, which generates business requests that are sent for approval

reasons. The responsible person reviews and approves this information via business requests and items.

The engine bundles the recertification items into business requests based on the object itself. Therefore, in this case, the business role and location are the bundles for the business requests, and its members are items.

The possible decisions for the business requests are generally set to certify or revoke the business role and location membership

. However, these decisions are configurable

.

If you would like more details on creating a business role and location membership recertification policy, visit the business role and location membership page.


Direct Reports	The Direct Reports recertification

process validates

policy collects access data to validate if the managers and their direct reports are still required for a valid business purpose.

Certain actions must be made if the direct report is no longer required or changed. In other words, the direct reports recertification policy is

The information is presented to the responsible person to certify whether a direct report for a particular manager should exist

.To complete creating a recertification policy, add Targets to define who or what to recertify and add Item Type Scope to limit which data/access to recertify. For the recertification, a recertification policy is created, a recertification audit is created, and the recertification policy is added to the audit

.

The audit is compiled, which generates business requests that are sent for approval.


Group Membership	The group membership recertification

process validates whether the membership of a group

policy collects access data to validate whether a group membership for a user is still required for a valid business purpose.

Certain actions must be made if membership is no longer required. In other words, the group membership recertification policy is to certify whether membership should exist or not.For the recertification, a recertification policy is created, a recertification audit is created, and the recertification policy is added to the audit. The audit is compiled, which generates business requests that are sent for approval.

This information is reviewed and approved by the responsible person who decides whether membership should exist.

The engine bundles the recertification items into business requests based on the object itself. Therefore, in this case, the group is the

bundle for the

business requests, and its members are items bundled into the request.

The possible decisions are generally set to certify or revoke the group membership.

However, these decisions are configurable. For more details on how to create a group membership recertification policy, visit the group membership recertification page.


Group Owner	The Group Owner membership recertification

process validates

policy collects access data to validate whether an account as a group owner is still required for a valid business purpose.

Certain actions must be made if the account should no longer own the group. In other words, the Group Owner recertification policy is to certify

This information is reviewed and approved by the responsible person during an Audit who certifies whether an account should own a group

.To complete creating a recertification policy, add Targets to define who or what to recertify and add Item Type Scope to limit which data/access to recertify. For the recertification, a recertification policy is created, a recertification audit is created, and the recertification policy is added to the audit

.

The audit is compiled, which generates business requests that are sent for approval.


Group Validity	The Group validity recertification

is a method of determining

policy collects access data to determine whether or not

groups are still required. Certain actions must be made if the groups are no longer required. In other words, the group validity recertification policy certifies

a group is still required. Auditors make a decision about whether a group should exist.

In

the group validity recertification process, a responsible person (group owner, responsible party, or other designated person) checks the group and decides whether this group should continue to exist.For

the

recertification, a recertification policy is created, a recertification audit is created, and the recertification policy is added to the audit. The audit is compiled, which generates business requests that are sent for approval.In the

case of group validity recertification, the recertification engine bundles the recertification items into business requests as per the

responsible

responsible party assigned. For any item being recertified where its responsible party is

null

not assigned, it bundles them into one business request as per the

fall-back

fallback assignee.

The possible decisions are generally set to certify, disable or delete.

However, these decisions are configurable. For more details on how to create a group validity recertification policy, visit the group validity recertification page.


Management Role Access Assignment	The management role access assignment recertification

process validates whether the

policy collects data to certify access granted to a management role is still required for a valid business purpose.

Certain actions must be made if access is no longer required.

In other words, the management role access recertification policy is to certify whether an access grant

should exist.For the recertification, a recertification policy is created, a recertification audit is created, and the recertification policy is added

to

the audit. The audit is compiled, which generates business requests that are sent for approval.The engine bundles

the

recertification items into business requests based on the object itself. Therefore, in this case, the management role is the bundle for the business request, and the access already granted is items.If you want more details on creating a management role access assignment type recertification policy, you can visit the management role access assignment page

management role should exist.
Management Role Membership	The management role membership

recertification process validates whether the membership of

recertification policy generates recertification data to certify whether a user's membership in a management role is still required for a valid business purpose

. Certain actions must be made if membership is no longer required

.

In other words, the management role membership recertification policy is to certify whether membership should exist.

For the recertification, a recertification policy is created, a recertification audit is created, and the recertification policy is added to the audit. The audit is compiled, which generates business requests that are sent for approval.

The engine bundles the recertification items into business requests based on the object itself. Therefore, in this case, the management role is the bundle for the business requests, and its members are items.

The possible decisions are generally set to certify or revoke the management role membership. However, these decisions are configurable.

For more details on creating a management role membership recertification policy, visit the management role membership page.


Management Role Validity	The management role

validity recertification is a method of determining whether or not management roles are still required. Certain actions must be made if the management roles are no longer required. In other words, the management role validity recertification policy certifies whether a management role should exist.

In the management role validity recertification process, a responsible person (owner, responsible party, or other designated person) checks the management role and decides whether this management role should continue to exist or not.

For the recertification, a recertification policy is created, a recertification audit is created, and the recertification policy is added to the audit. The audit is compiled, which generates business requests that are sent for approval.

In the case of management role validity recertification, the recertification engine bundles the recertification items into business requests according to the responsible party assigned. For any item being recertified where its responsible party is null, it bundles them into one business request as per the fall-back assignee.

The possible decisions for the business requests are generally set as certify, disable or delete. However, these decisions are configurable.

For more details on how to create a management role validity recertification policy, visit the management role validity recertification page.

membership recertification policy generates recertification data to certify whether a management role is still required for a valid business purpose.
Person Access Summary	The person access summary policy validates the person with all types of access assignments currently granted to a Person.

Simply

, this policy is to certify if a person should have the access that the person currently possesses.

The person access summary recertifies

All RBAC assignments, including direct, relative, and by-location assignments
Direct Business Role and Location assignments
Any group memberships, including those on their accounts and those granted through RBAC
Any Management Role memberships
Account and group ownership

To complete creating a recertification policy, add Targets to define who or what to recertify and add Item Type Scope to limit which data/access to recertify. For the recertification, a recertification policy is created, a recertification audit is created, and the recertification policy is added to the audit. The audit is compiled, which generates business requests that are sent for approval.


Person Validity	The person validity recertification

is a method of determining

policy determines whether or not the

person

Person object is still required.

Certain actions must be made if the persons are no longer required.

In other words, the person validity recertification policy

is to certify

certifies whether a

person

Person object should exist

or not

in EmpowerID.

In

the person validity recertification process, a responsible person (manager, responsible party, or other designated person) checks the person and decides whether this person should continue to exist.

For the recertification, a recertification policy is created, a recertification audit is created, the recertification policy is added to the audit, then the audit is compiled, which generates business requests that are sent for approval.

In

case of person validity recertification, the recertification engine bundles the recertification items into business requests as per the responsible party assigned. For any item

being

recertified

where its

whose responsible party is null, it bundles them into one business request as per the

fall-back

fallback assignee.

The possible decisions for the business requests are generally set as certify, disable, or delete. However, these decisions are configurable.

If you would like more details on creating a person validity recertification policy, you can visit the person validity recertification page.

Each Recertification policy is targeted or scoped to apply only to specific people, roles, or resources using EmpowerID query-based collections. These are comprised of sets, primarily SQL queries or code-based queries in some cases. These sets are re-evaluated by the EmpowerID engine on a scheduled basis and can group collections of people. They can be based on questions written against the EmpowerID identity warehouse or external systems in a customer's environment.

Tip
EmpowerID also supports real-time risk-based recertification of group membership changes as they are detected. This feature can be enabled per Account Store basis and is targeted to monitor only those groups defined in a Query-Based Collection per Account Store. More information is provided in the doc Continuous Group Membership Change Recertifications.

Insert excerpt

	IL:External Stylesheet
	IL:External Stylesheet
nopanel	true

Insert excerpt

	IL:External Stylesheet
	IL:External Stylesheet
nopanel	true

...

Versions Compared

Old Version 4

New Version Current

Key