PingOne Advanced Identity Cloud

Create an entitlement composition certification template

The Entitlement composition certification provides a review mechanism that allows certifiers to evaluate, review, and modify the definition of entitlements within the certification process. This capability enables reviewers to submit requests to change the entitlement definition, even independently of the certification decision, with options for drafting and deferring modification requests until sign off.

Details

This section includes basic information about the template, such as the display name, description, owner, and staging process.

To complete this section, do the following:

  1. In the Advanced Identity Cloud admin console, click Certification > Templates > add New Template.

  2. Click Entitlement Composition Certification.

  3. Click Next.

  4. On the Campaign Details page, complete the following fields:

    Field Description

    Certification Name

    Display name for the certification. This certification name displays on both the certifications tab and the end-user tasks dashboard.

    Define a date variable in the name of the certification to know which campaign kicks off. Identity Governance uses moment.js to format the date.

    For example, if you have a certification that’s scheduled to run every 2 weeks, appending the date to the name lets you know which campaign you’re working on. The certification name can include the date (year, month, day), time (hour, minute), and time of day (AM/PM):

    Campaign name: {{YYYY-MM-DD-hh:mma}}

    When you kick off a template into a campaign, an example of the name is: Campaign name — 2023-12-12-08:18pm

    After the campaign kicks off you can’t modify the name.

    Description

    Enter a general description for the certification. Your company should follow a descriptive convention to describe each of your certifications.

    This field is limited to 1000 characters.

    Campaign Owner

    Enter the owner of the campaign. Only campaign owners can fully control their certifications, including certification decisions, certifier assignment changes, sign off, and more.

    Enable Campaign Staging

    Enable certification staging to set up the certification in the system but not activate it in production. This option allows compliance officers to preview a certification before it’s activated and exposed to end users. Compliance officers can inspect and review the content, decision items, and other details to determine whether to activate or delete it.

  5. Click Next.

What to Certify

This section lets you define the items to certify, including the users, applications, accounts, and entitlements.

To complete this section, do the following:

  1. Complete the following fields:

    Field Description

    Entitlements

    Certify one of the following:

    • All entitlements

    • Entitlements matching a filter: Create a filter to certify specific entitlements.

      If you create a governance glossary attribute and enhance the onboarded entitlement(s) with the attribute, you can filter on the attribute(s) you create.

      Learn more in Manage governance glossary.

    Applications

    Certify one of the following:

    • All applications

    • Specific applications: If you select this, an additional box is displayed to select which Applications to certify.

    • Applications matching a specific filter: Create a filter to certify specific applications.

      If you create a governance glossary attribute and enhance the target application(s) with the attribute, you can filter on the attribute(s) you create. Learn more in Manage governance glossary.

    Hide advanced filters

    Click Filter by last certification decision. Enter the conditions:

    • All users or Any

    • Campaign ID

    • [.label]#contains/is/starts with/ends with

    • Enter a value in the field.

    Click add to add the condition.

    (Optional) Show advanced filters

    Click Filter by last certification decision. Enter the conditions:

    • All users or Any

    • Campaign ID

    • contains/is/starts with/ends with

    • Enter a value in the field.

    Click add to add the condition.

  2. Click Next.

When to Certify

Use these steps to specify when to launch the review process (campaign) and what to do in the event the campaign expires.

To complete this section, do the following:

  1. Complete the following fields:

    Field Description

    Schedule

    Define whether the template will kick off on a periodic basis. If selected, input various choices to define the schedule.

    Check the Run on a schedule box to define a schedule for the template.

    Options include:

    • Run Every: Run the certification every specified number of days, weeks, months, or years.

    • Start: Specify a date and start time when this campaign kicks off for the first time.

    • End: Run the certification on its defined periodic basis until this date and time is reached.

    Campaign Duration

    Specify the amount of time each access review (campaign) has before expiration. You can specify the duration in days, weeks, months, or years.

    When Campaign Expires

    Select a behavior to handle the open access review (campaign) line items when the campaign expires:

    • Close open items: Complete the items using the given information after the campaign expires. The administrator can select what decision to add to the item (certify, revoke, and allow exception to) and when that decision takes effect. The decision can take effect immediately or after a duration (in days).

    • Reassign to: Select a given user or role that the access review (campaign) is reassigned to after the expiration date. The campaign will not be closed.

    • Do Nothing: No action will be taken, and the line items will remain in progress.

  2. Click Next.

Who will Certify

This section allows you to specify the users that review and make decisions about the items you defined in the What to Certify section.

To complete this section, do the following:

  1. Complete the following fields:

    Field Description

    Certifier Type

    Specify who can review and certify user access by selecting one of the following:

    • User: Select a single user to review and make a decision on every record. When you select this, a Select user box displays. Select the user who will certify the campaign.

    • Role: Select a role that allows any of its members to review every record. When you select this, a Select a role box displays. Select a role from the list of the created roles in Advanced Identity Cloud.

    • Entitlement Owner: Select the user who manages the entitlement.

    • Custom certifier: Specify a custom certifier to review the request.

    Enable default certifiers

    Select a certifier to assign in case an access review (campaign) line item isn’t assigned a certifier. For example, if the manager is the certifier and the user has no manager defined, then the default certifier will be assigned the access review for this user.

  2. Click Next.

Notifications

Use these steps to configure email notifications for campaign events, such as when a campaign is triggered or when a certifier is reassigned:

Before selecting a notification, define an email template for each notification type (Email > Templates). Identity Governance includes preset templates for certification campaigns that you can copy and customize.

Unlike standard platform email templates where user attributes sit directly under an object (such as {{object.mail}}}}), Identity Governance emails contain multiple entities. You must prefix attributes with the specific entity name:

  • User attributes: object.user.userAttribute (for example, {{object.user.userName}} or {{object.user.mail}})

  • Manager attributes: object.manager.managerAttribute (for example, {{object.manager.mail}})

  • Campaign attributes: object.campaign.campaignAttribute. (Available attributes are name and type, such as {{object.campaign.name}})

To complete this section, do the following:

  1. Select any notifications you want to enable and configure the following fields:

    Field Description

    Send initial notification

    Send a notification to the certifiers when the campaign is triggered. Select an email template.

    Send reassign notification

    Send a notification to the new reviewers when an item is reassigned or forwarded to them. Select an email template.

    Send expiration notification

    Send a notification to the certifiers when the certification expires. Configure the following:

    • Email Template: Select the email template to use.

    • Expiration timing: Select when to send the notification.

    Send reminders

    Send certifiers reminders: Configure the following:

    • Email Template: Select the email template to use.

    • every: Enter the interval and select the time unit (days, weeks, and so on).

  2. Click Next.

    If a burst of campaign notifications temporarily triggers API rate limits, Identity Governance queues the emails and automatically retries delivery until all messages are sent. You don’t need to resend them manually.

Additional options

Use these steps to configure other options for a campaign, such as performing bulk certifications or reassigning tasks to another user or group:

  1. Complete the following optional fields:

    Field Description

    Enable line item reassignment and delegation

    Allow the certifier to reassign or forward a line item to another user.

    When you select this box, you can choose the following options:

    • Forward: Allow certifiers to forward their access review (campaign) to another certifier. When forwarding an access review, other certifiers are removed from the access review in its entirety. Learn more in forward line items.

    • Reassign: Select the privileges the current certifier can assign to the new certifier:

      • Add Comment

      • Make Decision

      • Reassign/Forward

      • Sign off

    Learn more in reassign line items.

    Require justification on revoke

    Require a mandatory comment or reason for the revocation.

    Require justification on exception

    Require a mandatory comment or reason for any allowed exception.

    Allow exceptions

    Allow certifiers to continue to certify line items assigned to them after the campaign expires. Select a duration in days, months, weeks, or years.

    Allow bulk-decisions

    Allow certifiers to make line item decisions in bulk.

    This includes:

    • Making a decision (certify, revoke, exception).

    • If Enable line item reassignment and delegation is enabled, then you can bulk Reassign or Forward line items.

    As an administrator, most access reviews require an in-depth look of each line item. This is to ensure accuracy of each item.

    Allow partial sign-off

    Allow a certifier to sign-off on an access review before their assigned line items have a decision made on them.

    Process remediation

    Revokes the end user’s access in the target application when a certifier revokes (denies) the line item. Select a workflow to run either immediately after revocation of access or after a duration.

    Enable escalation

    Enable certification escalation.

    Define the behavior when the campaign expires:

    • Close: Select Revoke, Certify, or allow exception to. Open items immediately or after a duration.

    • Reassign: Select Role or User, then select the role or user.

    • Do Nothing: Take no action when the campaign expires.

  2. Click Next.

Customization

Use these steps to configure the review grid displayed to certifiers. Selecting default columns, such as display names, descriptions, risk flags, and reviewer comments, ensures that certifiers have the necessary business context to evaluate role definitions without having to inspect each item individually.

  1. Complete the following optional fields:

    Field Description

    Application

    Select a value for application, such as Description and Name.

    Entitlement

    Select a value for entitlement, such as Description and Display Name.

    Review

    Enter Flags and Comments to add fields to the access review table.

  2. Click Next.

Summary

Use these steps to review what you configured:

In the What to Certify review section, ensure that the Total Decision Items is greater than 0. If Total Decision Items is 0, the template didn’t identify items to be certified, so if you create the campaign off of the template, the system immediately cancels the campaign. If Total Decision Items is 0, go back to the What to Certify section and adjust your settings.

Summary steps:

  1. Review each section.

  2. Click Save to complete the certification template.