Skip to content

Campaign Filters

Use a campaign filter to create a certification campaign that includes a subset of your entitlements or users.

Creating a Campaign Filter

1. From the Admin interface, go to Certifications > Campaign Filters.

2. Select New.

3. Under Filter Type, select the radio button for Exclusion or Inclusion, depending on the type of filter you want to create.

  • Exclusion filters exclude entitlements or identities from the campaign if they meet any of the criteria listed in the Filter Builder.

  • Inclusion filters include the entitlements or identities from the campaign if they meet any of the criteria listed in the Filter Builder.

4. Enter a name and description for your campaign filter.

6. Configure the campaign filter criteria. For examples, see Types of Campaign Filters.

7. Select Add to add a new filter.

Select the X icon to remove a filter from the list or check the box beside it on the list of campaign filters and select Delete from the Menu icon.

You can edit a campaign filter by selecting its name in the list of campaign filters. This does not affect in-progress campaigns.

8. Select Save.

Notes

  • Campaign filters were previously called exclusion rules and they were created by SailPoint. If you have exclusion rules in your org, they will still appear in your list of campaign filters.
  • Filter criteria are connected by OR operators, so identities and entitlements are filtered based on a match to any individual criteria you select.
  • To view a report on items that were filtered out of a campaign, you must enable the Campaign Exclusion Report using the API to Enable or Disable Campaign Exclusion Reports for New Campaigns
  • The Value field is not case sensitive, so words like "Eng" and "eng" are treated as the same value.

Types of Campaign Filters

You can create campaign filters using any of the following criteria types:

Access Profile

This criteria type includes or excludes access profiles from a campaign.

Examples:

An exclusion campaign filter is created with an operation of Equals and an Access Profile value of Base Building Access. All access profiles and entitlements appear in the certification campaign except for the access profile Base Building Access.

An inclusion campaign filter is created with an operation of Contains and an Access Profile value of Engineering. All access profiles whose name contains the word "Engineering" are included in the campaign.

Notes

  • Access profiles that are granted by roles or lifecycle states are not included in certification campaigns.
  • If an entitlement is part of an access profile, create an access profile campaign filter to include or exclude users with that access profile.

Account Attribute

This criteria type includes or excludes certification items that match a specified value in an account attribute.

Example: To exclude people whose Box account ID includes the numbers 123, select Account Attribute as the Criteria Type, Box as the source, Account ID as the attribute, Contains as the operation, and type 123 in the text field.

Entitlement

This criteria type includes or excludes entitlements from a campaign.

Examples:

An inclusion campaign filter is created with a source of Source 1, an operation of Equals, and an entitlement of Entitlement 1. When this filter is selected, only users who have Entitlement 1 are included in the campaign, and only Entitlement 1 is shown in the certification.

An exclusion campaign filter is created with a source of Source 1, an operation of Equals, and an entitlement of Entitlement 1. When this filter is selected, all users are included in the campaign, but Entitlement 1 is excluded from all certifications and can't be approved or revoked.

An inclusion campaign filter is created with a source of Source 1, an operation of Contains, and an entitlement value of Basic. When this filter is selected, only entitlements that contain the word "Basic" appear in certifications, and only users who have those entitlements are included for review.

Notes

  • Entitlements are filtered based on their display names.
  • When someone is granted the Certification Administrator user level, they are also granted a related entitlement in IdentityNow. However, you cannot filter on this entitlement at this time
  • If an entitlement is part of an access profile, only users who have the entitlement but not the access profile associated with it will be filtered by campaign filters based on that entitlement.

Identity

This criteria type includes or excludes specific identities from your campaign.

Examples:

An inclusion campaign filter is created with an operation of equals and a name of John Smith. When the filter is selected, only that identity is included in the campaign.

An exclusion campaign filter is created with an operation of equals and a name of John Smith. When the filter is selected, all applicable identities are included in the campaign except John Smith.

Identity Attribute

This criteria type includes or excludes identities based on whether they have an identity attribute that matches criteria you've chosen.

Examples:

An exclusion campaign filter is created with an attribute of Manager, an operation of Equals, and a value of john.smith, which is the account ID of John Smith. All identities with john.smith as a manager will be excluded from campaigns that use this filter.

An inclusion campaign filter is created with an attribute of Phone, an operation of Starts With, and a value of 555. Only identities with phone numbers starting with the numbers 555 are included in the campaign.

Role

This criteria type includes or excludes roles, as opposed to identities.

Examples:

An exclusion campaign filter is created with an operation of Equals and the Role Name of Role 1. Identities that are members of Role 1 do not appear in the certification campaign.

An inclusion campaign filter is created with an operation of Equals and the Role Name of Role 2. Only identities that are members of Role 2 are included in the campaign.

Source

This criteria type includes or excludes entitlements from a source you select.

Example: An inclusion campaign filter is created with an operation of Equals and a source name of Source1. Only identities and entitlements that appear on Source1 appear in the campaign, even if the campaign is a manager certification campaign.