Access Review Introduction
What are Access Reviews?
The practise of periodically checking a user's rights or entitlements (for resources or inside IDHub roles) to make sure they don't have unauthorised access, or access they don't need, is known as access review or certification. Managers or resource/role owners frequently pass the Access Certification. It is also known as User Access Reviews and Periodic Access Reviews (PAR) in the industry. It is a crucial component of IDHub, a crucial security measure, and is necessary to demonstrate compliance with several industry norms and rules.
What is Certification Definition?
An access certification's content has to be specified. Using the certification definition function in IDHub, it is defined. An access certification can be set up to execute either once or repeatedly by an IDHub admin user. According to the definition, the administrator must supply certain fundamental details, including the name, type of certification—user or resource—description, choice of user or resource base, frequency of certification request triggering, duration of certification/campaign, local configuration parameters for certification, and event triggers for ad hoc certification request release.
A "Certification Request" (each certification request marks the beginning of a campaign), which is visible in the "Requests" tab, will be released after a Certification definition has been produced and after its scheduled run or one-time run. When a certification request is approved, the process that goes along with it creates certification tasks that are placed into the certifier's mailbox, or the "Tasks" page.
Why do you need a Access Review?
To fulfil the organization's compliance and regulatory duties, access certificates are the greatest and most visible problem most organisations confront. Industry experts have emphasised the significance of an IDM system offering access certifications (access review) capabilities to relieve the workload of human labor-intensive, time-consuming, and prone to mistake assessments based on spreadsheets. The business user will benefit from this where they need it most. Access Certifications is a sizable module, thus we want to provide features in tiers, beginning with the most crucial value addition for the organisation.
Understanding the Flow
How many type of certification you can create?
IDHub Certifications can be of 2 types:
| Type | Description | Who is the Certification Administrator ? |
| Certification of User Access | Allows reviewer to certify user's access to roles, applications and entitlements | Access Manager IDHub Administrator * Resource Owner (Can only define/manage cert definitions for resources owned by them) |
| Certification of Resource Assignment | Allows reviewer to certify user's access to resources they own. |
Which roles typically does certification?
| Certification Role (Non IDHub) | IDHub Role | Description - What do they do? |
| System Admin(Global) | Access Manager IDHub Administrator | A system admin has global access to certification(s) within the organization. This role has all the permissions of a Certification Administrator, Certification Performer, and Certification Viewer and also sets global certification configuration parameters for the Enterprise. |
| Certification Administrator | Access Manager IDHub Administrator * Resource Owner (Can define/manage cert definitions for resources owned by them only) | A Certification Administrator can Add new certification definition Search certification definition List certification definition Edit certification definition Run Now. View related certification requests (each certification request is the start of a campaign) Approve certification requests View and Export reports for completed tasks. |
| Certification Performer (Certifier/Reviewer) | * End Users (Most likely these will be beneficiary's managers. End Users should not be able to certify for themselves.) | The Certification Tasks ( certify or reject access of users) are performed by this role. This role also has access to reports and the ability to view and export certification reports. Certification tasks are found in Tasks (Inbox) within User App. |
Some important information
- A certification task review can only be reassigned to a certification performer.
- In a multi-phase review (applicable only to user certifications) the certification task can only be assigned if the user is a certification performer. (All user managers, role owners, and resource owners are by default a certification performer.
- A Certification Performer can also be a Certification Administrator.