Overview

This use case describes how IGA Admin can manage privilege accesses and their availability on the Self-Service Portal. 

Operators

IGA solution
Self-Service Portal
IGA Admin

Prerequisites

Technical account, which IGA solution is using for reading and writing data towards directories or applications, needs to have enough permissions to manage also admin level accounts and accesses (for example if in AD, IGA solution is managing Domain Admins, service account needs domain admin level accesses to the Customers directory).  

Result

IGA Admin can manage, report and audit privilege level accesses and accounts. 

Users with privilege accesses can be re-certificated more often and during auditing information is up to date. 

Operating chain 

1. IGA solution reads user accounts and group information from directories (via Efecte Provisioning Engine) or applications (via integration). 
   
   
   • Privilege user accounts are read to IGA Account datacards
     
     
     • If users with privilege accesses are located in own OU (AD and OpenLDAP) or can be filtered (Azure AD), IGA solution automatically marks these user accounts as privilege. 
       
       
       • This requires separate provisioning task to be configured in IGA solution (IGA Module Admin) 
         
         
     • If user accounts are marked with prefix or suffix in the name, IGA Admin can open view for IGA accounts with the prefix or suffix and use modify all action to mark user accounts (IGA Account) as privilege. 
       
       
     • IGA Admin can also modify IGA Accounts by opening them one by one and changing IGA Account type to privilege account.
       
       
   • Privilege groups are read to IGA Entitlement datacards
     
     
     • If groups with privilege accesses are located in own OU (AD and OpenLDAP) or can be filtered (Azure AD), IGA solution automatically marks these groups as privilege. 
       
       
       • This requires separate provisioning task to be configured in IGA solution (IGA Module Admin) 
         
         
     • If groups are marked with prefix or suffix in the name, IGA Admin can open view for IGA Entitlements with the prefix or suffix and use modify all action to mark user groups (IGA Entitlement) as privilege. 
       
       
     • IGA Admin can also modify IGA Entitlements by opening them one by one and changing IGA Entitlement type.
       
       
2. IGA Admin can fulfill privilege IGA Entitlement information and publish them to be available in the Self-Service Portal 
   
   
   • Please check, use case for Manage IGA Entitlements
     
     
3. IGA Admin can also create Re-certification request related to only privilege accesses and accounts. 
   
   
4. Existing users with privilege account can now use "Request Privilege Accesses" and "Activate Privilege Accesses" services from the Self-Service Portal
   
   
   • Before these services can be used, IGA Admin needs to disable all privilege accounts by using modify all function. 
     
     
5. Users can also request privilege account from the Self-Service Portal, by choosing "Request Privilege Account" service. 
   
   
6. IGA Access Right Records are created and audit details are saved. 

Related datacards

IGA Entitlement
IGA Account

Views and dashboards

• Activated privilege accounts (privilege IGA Accounts in use)
• Disabled privilege accounts, with permissions to use privilege accesses
• Privilege accounts expiring in one week
• Privilege IGA Entitlements