Phased Availability
Functionality available to select customers. Visit New Capability: SailPoint next generation certification for more information.
Starting a Campaign
Use the flexibility of search to create certification campaigns for the identities and accounts you have loaded into SailPoint Human Fabric. When you start a campaign, you can create a certification campaign for access items, identities, or roles based on your search query results.
You can create a precise search query to limit a campaign to a specific set of identities and access items. The more refined your query is, the more refined your results will be.
Configuring Certification Campaign Contents
You can certify the following items when you create certification campaigns:
- Identities - Review access items for specific identities.
- Access Items - Review a set of roles, access profiles, or entitlements for the identities that have them.
- Roles - Review a role’s composition, including its title, description, membership criteria, and the access included in the role.
- Uncorrelated Accounts - Review access items for uncorrelated accounts, source accounts that are not linked to an authoritative identity.
-
Machine Accounts - Review access items for application identities. These identities represent a program or process that machine accounts, like service accounts, bots, or other types of non-human accounts, are grouped within.
Creating an Identity Certification Campaign
With identity certification campaigns, you can define campaigns based on the identities you want to certify.
- Select Search from the navigation menu.
- From the vertical toolbar, select the Certification Campaigns icon.
-
Select the New Campaign button.
Tip
The top navigation bar includes a shortcut to this page. Select the Add icon
, then Certification Campaign. -
Select the Identities tile.
-
Select Create Campaign for one of the following methods:
-
Using a Search Query to determine the contents. Continue to step 6.
-
Using a Campaign Filter to determine the contents. Complete the steps to configure the details.
Note
SailPoint recommends creating campaign filters before campaign creation to have templates available.
-
-
Select how you want to search for identities:
Note
When you refine identities, the maximum number of identities that can be selected based on your query is 10,000.
-
All Identities Returned by a Query allows you to build a search query to run for all the identities you want to include.
- Select Certify These Identities to add them to your campaign.
-
Specific Identities that I Select allows you to build a search query to run for specific identities you want to include.
- Select the checkbox for the identities.
- Select + Add To Campaign.
- (Optional) Review your selections in the Added to campaign tab.
- Select Certify Selected Identities when you’ve completed your selections.
-
-
Choose how you want to certify access.
-
Certify All Access includes all access items associated with the identities in the campaign. You can now configure the details of your certification campaign.
-
Refine Access Items filters which access items you want to include in the certification campaign. Complete the following steps:
- Select which access items you want to include in the certification campaign.
Note
When you refine access, a maximum number of 10,000 total access items can be displayed.
- Select + Add to Campaign to save your selections for each access type.
- (Optional) Review your selections in the Added to campaign tab.
- Select Continue to configure the details of your certification campaign.
-
Creating an Access Item Certification Campaign
Access item certification campaigns allow you to define campaigns with a focus on the access you want included.
- Select Search from the navigation menu.
- From the vertical toolbar, select the Certification Campaigns icon.
-
Select the New Campaign button.
Tip
The top navigation bar includes a shortcut to this page. Select the Add icon
, then Certification Campaign. -
Select the Access Items tile.
-
Select Create Campaign for one of the following methods:
-
Using a Search Query to determine the contents. Continue to step 6.
-
Using a Campaign Filter to determine the contents. Complete the steps to configure the details.
Note
SailPoint recommends creating campaign filters before campaign creation to have templates available.
-
-
Select how you want to search for access items:
Note
When you refine access items, the maximum number that can be selected based on your query is 10,000.
-
All Access Items Returned by a Query allows you to build a search query to run for all the items you want to include.
- Select Certify This Access to add them to your campaign.
-
Specific Access Items that I Select allows you to build a search query to run for specific items you want to include.
- Select the checkbox for the access item.
- Select + Add To Campaign.
- (Optional) Review your selections in the Added to campaign tab.
- Select Certify This Access when you’ve completed your selections.
Notes about entitlements and access profiles
Entitlements
- Identities that have the entitlement you select as a standalone entitlement will be included in the campaign.
- If the selected entitlements were granted as part of a role or access profile, that role or access profile must be selected for certification to include those identities in the campaign.
- If an identity has access to all the standalone entitlements that comprise an access profile, they will be granted that access profile and are no longer considered to have the entitlement as standalone.
Access Profiles
- Identities that have the access profile you select as a standalone access profile will be included in the campaign.
-
If the selected access profiles were granted as part of a role, that role must be selected to include those identities in the campaign.
-
Select + Add To Campaign to save your selections for each access type.
- (Optional) Review your selections in the Added to campaign tab.
- Select Certify This Access when you’ve completed your selections.
-
-
Choose how you want to certify access.
-
Certify All Access includes all access items associated with the identities in the campaign. You can now configure the details of your certification campaign.
-
Refine Access Items filters which access items you want to include in the certification campaign. Complete the following steps:
- Select which access items you want to include in the certification campaign.
Note
When you refine access, a maximum number of 10,000 total access items can be displayed.
- Select + Add to Campaign to save your selections for each access type.
- (Optional) Review your selections in the Added to campaign tab.
- Select Continue to configure the details of your certification campaign.
-
Creating a Role Composition Certification Campaign
Role certifications are typically assigned to role owners, who certify the composition of that role. Revoked decisions in these campaigns will generate manual tasks for the users responsible for remediation.
Note
Role composition certification campaigns will be migrated to the new certification campaign engine in a future release, so there will be a "legacy" tag on the page. Administrators will see these campaigns under "Legacy Campaigns" in the administrative UI.
- Select Search from the navigation menu.
- From the vertical toolbar, select the Certification Campaigns icon.
-
Select the New Campaign button.
Tip
The top navigation bar includes a shortcut to this page. Select the Add icon
, then Certification Campaign. -
Select the Role Composition tile.
-
Choose how you want to select roles:
If you choose All Roles Returned by a Query, all roles returned by your query will be added to the certification campaign. Complete the following steps:
-
Run a search query to return a list of roles. Note that dynamic roles are excluded from certification reviews.
-
Select Certify These Roles to add these roles to your certification campaign.
If you choose Specific Roles That I Select, you can search for roles you want to certify and add each one individually to your certification. Complete the following steps:
- Run a search query to return a list of roles.
-
Select which roles you want to include in the certification campaign. Note that dynamic roles are excluded from certification reviews.
-
Select + Add To Campaign to add these roles to your certification campaign.
- Select Certify Selected Roles when you’ve completed your selections.
-
You can now configure the details of your certification campaign.
Creating Uncorrelated Accounts Certification Campaigns
Uncorrelated accounts certification campaigns allow you to certify source accounts that are not linked to an authoritative identity.
- Select Search from the navigation menu.
- From the vertical toolbar, select the Certification Campaigns icon.
-
Select the New Campaign button.
Tip
The top navigation bar includes a shortcut to this page. Select the Add icon
, then Certification Campaign. -
Select the Uncorrelated Accounts tile.
- Choose accounts to certify by selecting sources from the list. If a selected source has uncorrelated accounts, they will appear in the accounts list below.
- Select Certify These Accounts.
You can now configure the details of your certification campaign.
Creating a Machine Accounts Certification Campaign
Machine account certification campaigns allow users to review an application identity's access.
- Select Search from the navigation menu.
- From the vertical toolbar, select the Certification Campaigns icon.
-
Select the New Campaign button.
Tip
The top navigation bar includes a shortcut to this page. Select the Add icon
, then Certification Campaign. -
Select the Machine Accounts tile.
-
Choose machine accounts to certify by selecting sources from the list. If a selected source has machine accounts, they will appear in the accounts list below.
Important
Machine account certification campaigns must contain less than 100,000 accounts. Campaigns with more than 100,000 accounts should be split into smaller, separate campaigns.
-
Select Certify These Accounts.
You can now configure the details of your certification campaign.
Configuring Certification Campaign Details
Before you can preview, start, or schedule a campaign, you'll need to enter your campaign information.
- Enter a meaningful Campaign Name and Description for your campaign to differentiate it from other certification campaigns.
- If your organization has the Recommendations feature, select the Include Recommendations in your campaign toggle to add recommendations to your identity and access items certification campaigns.
-
(Optional) Select an existing Campaign Filter from the dropdown list. You can also create a new filter by selecting Create Filter.
Note
Campaign filters can be used for both legacy and new campaigns.
-
Choose whether reviewers receive notification emails about the campaign’s progress.
-
Select who will review and remediate access. The Reviewer options are dependent on the certification campaign type. Each type of certification campaign will display the respective reviewer options from the following list:
- Manager - The manager of the identities in the campaign review access. If an identity does not have a defined manager, the certification is reassigned to the creator of the campaign.
- Individual - A specific identity reviews access. Select an individual from the dropdown list.
- Role Owner - The role owner reviews access. Role certifications are typically assigned to role owners, who certify the composition of that role.
- Source Owner - The source owner reviews access. Source owners are typically assigned to review uncorrelated accounts.
- Governance Group - A governance group reviews access. Select a governance group from the dropdown list. Any member of the governance group can perform the review. Governance groups may be assigned as reviewers in identity, access item, and role composition certification campaigns.
- Account Owner - The account owner reviews access. If an account owner has not been configured, the certification review will be assigned to the source owner.
- Access Owner - The primary owner of the access item is the default reviewer. If no owner is assigned, the system moves through the hierarchy to the next owner in this order: role owner, access profile owner, entitlement owner, and then source owner.
-
Choose what happens to undecided access when the campaign ends.
Caution
SailPoint strongly recommends that you choose to maintain access to undecided items due to the difficulty of reinstating access after it is revoked.
-
Choose when reviewers are required to leave comments on their decisions.
Best Practice
SailPoint recommends requiring comments when a decision is revoked in role composition certification campaigns. These comments are sent to the role owner as a task and dictate what changes they should make to the associated role.
-
For role composition campaigns, select an org or role admin to be the remediation owner. This user is responsible for manually updating the role when reviewers revoke items in role composition certifications. The revoked items in this campaign will become tasks in the remediation owner's Task Manager.
-
Choose when to generate the preview. You can opt to:
- Save the campaign as a template only.
-
Schedule a preview generation and save as a template.
- Options with display for you to select a time zone, an end date, and whether you want the preview to generate on a specific date or on a recurring basis.
-
Generate a preview now and save as a template.
- Generate the preview now and start the campaign with no saved template.
- An option will display for you to enter a campaign due date.
Notes
- When you schedule a campaign preview, you’re scheduling the generation of the preview. An admin must still manually start the campaign.
- A campaign's due date cannot be set to today's date.
- An email will be sent to the campaign owner one week before the scheduled campaign preview generation to remind them to manually start the campaign.
-
Select the due date of the campaign.
-
Select Review Campaign to review a summary of the campaign.
Important
The creation of a certification campaign is a critical governance process that should be carefully reviewed before it is sent to reviewers.
Note
Depending on the size of a campaign, previews may take some time to generate. For example, smaller campaigns may take 10-15 minutes, whereas large campaigns may take a couple of hours.
-
After you’ve reviewed the campaign details, select the blue button at the top of the page to save, schedule, or generate the campaign preview.
If you chose to generate your campaign preview, select View to display your campaign preview where you can start your campaign.
If you chose to save or schedule your campaign preview, you can find your campaign within the Saved/Scheduled tab on the Certification Campaigns page.
Note
Select the Legacy Saved/Scheduled tab for legacy certification campaigns.
Scheduling a Saved Certification Campaign
If you want to schedule a campaign that you’ve saved, you can do so from the Certification Campaigns page.
- Select Search from the navigation menu.
- From the vertical toolbar, select the Certification Campaigns icon.
- Choose the Saved/Scheduled tab, and select a saved campaign.
- On the Campaign Summary page, select Schedule to begin the scheduling process.
-
Select your time zone, an end date, and whether you want the preview to generate on a specific date or on a recurring basis.
Note
To schedule quarterly campaigns, select Recurring > Annually and select the checkboxes for each month you want to schedule.
-
Select Next to view a summary of your scheduled campaign information.
-
Review the summary and then select Schedule to schedule the campaign preview.
You can view your campaign in the Saved/Scheduled tab
Note
Select the Legacy Saved/Scheduled tab to view and access your legacy saved and scheduled certification campaigns.
An email will be sent to the campaign owner one week before the scheduled campaign preview generation to remind them to manually start the campaign.
Note
If you generate a scheduled campaign preview early, a preview will still be generated at the time and date you originally selected.
Starting a Certification Campaign
After your campaign preview has been generated, you can start your campaign.
- Select Search from the navigation menu.
- From the Search vertical toolbar, select the Certification Campaigns icon.
- Select the View Previewed/Active link at the top of the page.
- Select the Preview Ready button, and choose a certification campaign by selecting its name.
- Select Start Campaign at the top of the page to start the certification campaign.
Documentation Feedback
Feedback is provided as an informational resource only and does not form part of SailPoint’s official product documentation. SailPoint does not warrant or make any guarantees about the feedback (including without limitation as to its accuracy, relevance, or reliability). All feedback is subject to the terms set forth at https://developer.sailpoint.com/discuss/tos.