Manage automated rules
Discover how to create, edit and optimize automated rules
Manage automated rules
Discover how to create, edit and optimize automated rules
Manage automated rules
In this article are described use cases for IGA admins to be able manage automated rules, which are used for granting access rights (entitlements and/or business roles) automatically to users, based on user's employment related information like for example, organizational unit, cost center or titles.
IGA solution has capabilities to manage different type of rules,
- Attribute-Based Access Controls (ABAC) - Grant or remove access rights automatically based for example information like “is user a manager?”
- Role-Base Access Controls (RBAC) - Grant or remove access rights automatically based on users title
- Organizational-Based Access Controls (OrBAC) - Grant or remove access rights automatically based on users organizational unit or cost center
- One-time mass updates - Grants or removes entitlements or business roles to/from users. IGA admin can execute when needed.
It is important to separate automated rules from birth rights, which are managed via account management settings, and are granted only once when account is created (to all users who has same user type).
Both birth rights and automated rules can be used simultaneously, and in these cases birth rights are granted first and automated rules after that, which means that automated rules can overwrite / change immediately birth rights (for example all employee type of users will get minimum access to email, but based on automated rule for certain users with same title/organizational unit/cost center will get extended access to email).
This use case is part of IGA Growth and Enterprise packages.
Important!
Access rights granted based on automated rules, are always also removed based on the rule. This means that end-user cannot remove automatically granted access rights from Self-Service, but can see them as active access rights in Self-Service.
Use case descriptions
Use cases for automation
In this chapter are described use cases how automated rules are granting or removing access rights (entitlements and/or business roles) from/to the user, during user lifecycle management processes.
User can see from Self-Service own access rights granted based on automated rules, but cannot request them to be removed.
Manager can see from Self-Service own and subordinates access rights granted based on automated rules, but cannot request them to be removed.
| Description | |
| Overview | In these use cases are described how automated rules are working as a part of user lifecycle management use cases. These use cases are fully automated, please check own chapter for IGA admin use cases. |
| Operators | IGA solution |
| Prerequisites | Customer has user lifecycle management use cases in use (users employment related information are received from source system). |
| Result |
Automated rule is granting or removing access rights based on received users employment related information.
IGA admin can use automated rules also for one-time mass updates. |
| Automated rules during user creation |
|
| Automated rules during user updates |
|
| Automated rules during update departing user information |
|
| Automated rule for one-time mass updates |
|
Use cases for IGA admins
In this chapter are described use cases for IGA admins to be able to create, update, inactivate and report automated rules.
| Description | |
| Overview | In these use cases are described how IGA admin can define and change automated rules, which are used for granting or removing access rights automatically to/from users based on their employment related information. IGA admin can also use automated rules for one-time mass updates. |
| Operators |
IGA admin IGA solution |
| Prerequisites | Customer has user lifecycle management use cases in use (users employment related information are received from source system). |
| Result |
IGA admin has created/updated/inactivated automated rule. Automated rules are granting or removing access rights (entitlements and/or business roles) based on received users employment related information or based on IGA admin actions. |
| Create automated rule |
|
| Update existing automated rule |
|
| Inactive existing rule |
|
| Auditing & reporting |
IGA solution contains ready-made reports for automated rules, but mainly reporting is made when auditing users access rights, or entitlement relations.
IGA admin can easily create new reports and dashboards, share them with others or save them as personal reports. |
Delivery instructions
Relations & configuration instructions
Here are described relations to other use cases and configuration instructions.
Relations to other use cases,
User lifecycle management
Account management
Manage organizational data
Relations to other data cards,
IGA Access Right Record
IGA Entitlements
IGA Business Roles
Organization
Title
Cost Center
Configuration instructions,
Configure workflows,
-
Go to IGA Automated rule template and workflow called “IGA Automated rule”
-
Publish the workflow
-
Publish the workflow
-
Go to IGA Access Right Record template and workflow called “2.0 Add or remove group membership”
-
Publish the workflow
-
Publish the workflow
-
Go to IGA Service Request template and workflow called “2.5 Automated rule change request”
- Publish the workflow
Configure connector,
- Configure connector for the directory and test connection
-
Configure event-based task called “[Directory] IGA Access Right Record: Remove or Add Group”
- Define user and group filters and settings
- No need to change user identity mappings
System- and approval testing instructions
Testing automated rules are depended on user lifecycle management testing, and it is recommended to perform these simultaneously.
Preparations,
- Work period and account management settings are in place
- User's personal and employment related information are received with one of the options in user lifecycle management
- IGA admin has validated data received data is up to date and automated rules can be based on the data
- IGA admin has created necessary IGA automated rule data cards, matching users employment related information
- Title, cost center and organizational unit data cards can be found from IGA solution and automated rules are related to those.
Testing instructions,
-
Create, update and depart users according to user lifecycle management use cases
- Validate from IGA solution, that new users are granted with access rights defined in the rule from following data cards related to the user
- Person
- IGA account
- IGA work period
- IGA entitlement
- IGA business role
- IGA identity storage
- IGA access right record
- Validate from the customers directory that group-membership connections are correctly provisioned
- Validate from Self-Service
- User can see access rights in My Things view
- Manager can see subordinates access rights in My Employee view
- Validate from IGA solution, that new users are granted with access rights defined in the rule from following data cards related to the user
- Change existing rule content
- Add and remove entitlements and/or business roles from existing rule and change rule attributes.
- Validate that provisioning preview is working correctly
- Validate that changes are provisioned correctly to the customers directory/directories
- Validate from IGA solution that data is updated correctly to following data cards related to the user
- Person
- IGA account
- IGA work period
- IGA entitlement
- IGA business role
- IGA identity storage
- IGA access right record
- Add and remove entitlements and/or business roles from existing rule and change rule attributes.
- Inactivate existing rule
- Inactive and select execution time for existing rule
- Validate that provisioning preview is working correctly
- Validate that changes are provisioned correctly to the customers directory/directories
- Validate from IGA solution that data is updated correctly to following data cards related to the user
- Person
- IGA account
- IGA work period
- IGA entitlement
- IGA business role
- IGA identity storage
- IGA access right record
- Title / cost center / organizational unit
- Inactive and select execution time for existing rule
Table of Contents