Working with Access Certification Service

The first step of the Access Certification Campaign is that a responsible person creates a campaign and defines the campaign details as the name, planned duration, and at least one coordinator. In the next step, campaign data needs to be selected. This includes the set of users, access, and systems that are in the scope of the campaign by applying filters such as department, location and so on. Afterward, a workflow template needs to be chosen. There are different templates with several stages available.

The campaign then needs to be reviewed and submitted so it can start for the maintained planned duration. Notifications to reviewers can be sent. It can also be saved as a draft for later editing. The campaign closes automatically after all review items are processed or after the planned duration has ended.. Rejected access will be removed. Afterward, the campaign can be audited by reviewing the Access Certification Audit Log.

The Create Campaign app allows administrators to create, edit and submit campaigns. Creating a new campaign consists of three main steps:

• General Information
• Data Selection
• Workflow Selection

You can only edit campaigns that are displayed with the Saved status and that have not yet started.

In the first step, General Information, provide the details as the campaign name, description, planned duration, coordinators, and a specification about a notification.

The steps to perform are as follows:

1. Open SAP Cloud Identity Access Governance Fiori Launchpad (FLP).
2. Navigate to Access Certification→Create Campaigns.
3. Create new entry by choosing + New Certification Campaign button.
4. Enter the campaign name in the Campaign field. Spaces and special characters are allowed.
5. Enter a meaningful description of the certification campaign. This field is optional.
6. Enter the Planned Duration. This defines the amount of time that the campaign will last. The start date must be today or in the future. The end date must be equal to or later than the start date.
7. Enter one or multiple Coordinators. A coordinator is a person responsible for managing this campaign.
   Note

   Only users who have been assigned to the user group IAG_CPG_CO in IAS can be selected as coordinators when creating a campaign.

8. You can enable notifications. If sending notifications is selected, the coordinator receives a notification about the upcoming end of the campaign's planned duration by maintaining the field for the days before the due date.
9. Choose Next Step.

In the next step, Data Selection, relevant information in the search fields should be set to define the set of users, access, and systems that should be part of the campaign. These filters allow you to choose exactly what needs to be evaluated. By default, all users and all access are selected.

The Access filter allows you to select single roles, composite roles, business roles, profiles, groups, and SAP SuccessFactors static groups.

The Application filter lets you choose at least one system. Use the Access validity filters (Access Valid From and Access Valid To) to specify the data period, meaning the period of time for which the user access should be considered.

The User filter allows you to select or deselect individual users if required.

The User Assignment table below the filter bar shows you the result list based on your data selection. The filter bar can be hidden by choosing Hide Filter Bar.

You can adjust the default filter bar by choosing the Filters button at the right. This opens a popup to specify the same filters.

You can save a selection variant and reuse it as a set of filters for future campaigns by choosing the dropdown button next to Standard*. To save your filter selection for future campaigns, choose Save As. Insert a name for the view and save (optional).

To select the data in the filters bar, use the value help next to each field in the filter bar to select the values.

1. Choose the value help in the Access field and search for an access. You can also specify the access type here by choosing the value help and defining conditions.
2. Choose Ok and Go to receive the access items that were filtered.
3. Select the access items and choose Ok. The result list will be updated in the User Assignments section.
4. Repeat the steps above for the other filters as well if needed.
5. Choose Next Step.

In the next step of Workflow Selection, a workflow template needs to be selected. There are multiple workflow template like a one-step workflow, two-step workflow, and three-step workflow. The proper workflow template depends on the business needs.

The steps to perform are as follows:

1. Select a workflow template according to your business need.
2. Choose Next Step.

In this step, you can review the maintained information, and you can edit data if needed. After that, you can choose between Save as Draft or Submit.

If you choose Save as draft, you can view the status on the initial screen. The status should be Saved. If you select the draft campaign, you can edit or delete it by clicking the two buttons on the right top corner.

If you choose Submit, the Access Certification will start the campaign at the beginning of the planned duration that you selected earlier. At that point, the review requests will be created and the campaign will be in progress.

When the campaign is In Progress, it can be found in the Manage Active Campaigns app where coordinators can view its status and monitor and manage the progress of the campaign.

The Manage Active Campaigns app is used by coordinators to see the overall status of campaigns. Ongoing campaigns are shown as the default view. You can also view closed campaigns if you need to research campaigns that have already been processed or closed.

You can review your certification campaigns and can see the name of the certification campaign followed by the description (if available), the workflow template, the Review Area, which is the Access, the current workflow stage of your ongoing campaign, and the planned duration as well as the progress status.

The Planned Duration column reflects the dates that the campaign is scheduled to run. The Progress Status shows the percentage and the number of items that have been reviewed. For closed campaigns, this column is replaced by Actual Completion that shows the date and time of completion.

If authorized you can close an existing campaign after selecting it. This option removes the action items from the Reviewers' inboxes (Campaign Reviewer Inbox app) and can be done at any stage.

When selecting a campaign, you land in the Metrics section. There, you can see a graphical representation of the campaign. It includes Tasks by Status in Current Stage and Tasks Completed Over Time. The Reviewers section below shows the list of reviewers for the campaign and what status the review is in. In this section you can do the following:

• reassign tasks to a different reviewer
• remind the current reviewer that there are items to review

  The remind option sends an e-mail notification to the reviewer(s)

• escalate the task to the reviewers' manager

  The escalate option sends an e-mail notification to the manager if available

• release the claimed task by selecting a reviewer
  Note

  In the Campaign Reviewer Inbox app, you can view the created campaigns. If you select a campaign, you become a current reviewer by claiming the campaign. The campaign cannot be claimed by others. It has to be released first.

Steps to be performed in the Manage Active Campaigns app:

1. Open SAP Cloud Identity Access Governance Fiori Launchpad (FLP).
2. Navigate to Access Certification→Manage Active Campaigns.
3. Select an ongoing campaign.
4. Check the status of the tasks in the Metrics section.
5. Scroll down to the Reviewers section or select the Reviewers tab.
6. Select at least one of the Reviewers that for whom you need to Reassign, Remind, Escalate or Release and select the corresponding button in the top right above the Reviewers table. The changes will take effect to the ongoing campaign.

In the Campaign Reviewer Inbox app, the reviewer can access and review his assigned campaigns and their tasks. The reviewer can have any of the following roles:

• Manager
• Assignment Approver
• Security

The first screen shows an overview of the campaigns assigned to the reviewer. On the screen, you can see the name of the campaign and its description, the current workflow stage (Manager, Assignment Approver, Security) of the campaign, the date that the campaign is due followed by how many days remain or by how many days the campaign is overdue, workflow information, and the number of items that have been processed and what percentage has been completed. You can use filters to search for a campaign by name, filter by the progress status or by selecting a due date.

When you are selecting a campaign, it is possible to choose the Forward button, which opens a popup of eligible reviewers. Choose one to send the campaign to another person for analysis. This analysis removes the campaign from your reviewer inbox.

Choose a campaign to see the details and to process the campaign. When you select a campaign, you will see the Review Items. There you can see the name of the access that is considered, the name of the system to which the access applies, and the user ID of the user who has the access. The Risk Count field displays the number of SoD risks associated with an access. The risk count helps the manager to see how many risks the relevant access has presently. The Max Risk Level displays the various levels of risks - low, medium, or high. Depending on the level of risk, the manager can decide whether to remove the access from the user or not. The Access Validity Period displays the assignment validity of the access for this system.

You can search for Review Items or filter the items by selecting All, Processed, and Not Processed. Processed means that the line item has been approved or removed.

To perform a review, select approve or reject for each line item individually or choose the Approve All/Reject All buttons to handle all line items. You can also add a comment by selecting the review item or Comment all Review items by choosing the corresponding button.

After all actions have been performed and you have finished the review so that the campaign enters the next workflow stage, choose Save or Submit. Save will only save it as a draft so that you can continue later. Submit will submit the workflow to the next stage.

Auditors and others can use the Access Certification Audit Log app to view the audit-relevant actions taken on access certification campaigns and to verify that all follow-up actions have been completed for a campaign. Everyone who processes campaigns can use this app to verify what actions have been taken and when they were taken. The app lists all campaigns with the name, the actual status (closed / in progress), the planned duration and due date for the ongoing campaigns. Closed campaigns are listed with the close date. Additionally, for ongoing campaigns the current stage depending on the workflow template is also listed. Use the Search field to find specific campaigns.

After you select a campaign, you will see the complete lifecycle of all actions taken on the individual campaign including activities that were performed during the campaign, by whom they were performed, and the date and time.

To access the log, perform the following steps:

1. Open SAP Cloud Identity Access Governance Fiori Launchpad (FLP).
2. Navigate to Access Certification→Access Certification Audit Log.
3. Select a campaign.
4. View the log of this campaign.

You use the Access Certification Campaign Log app to view details about the creation of review requests after the campaign has started. In addition, the app helps you to verify that the steps have been properly created and to note any messages that were created.

You select a campaign form the list. The app displays the log history details for that campaign. This includes any messages generated by running the request creation.

To display it, perform the steps:

1. Open SAP Cloud Identity Access Governance Fiori Launchpad (FLP).
2. Navigate to Access Certification→Access Certification Campaign Log.
3. Select a campaign.
4. View the log of this campaign.