Overview

During the rollout of Okta Identity Governance (OIG), you might want to test the completeness of a certification campaign without sending emails to reviewers. For instance, by running the campaign silently, campaign administrators can confirm if the correct individuals are being reviewed or if any reviewers are being reassigned to a fallback reviewer. This article explains how to manually disable these emails or restrict their audience for testing purposes.

Identify and Locate Email Templates

The email templates that are sent to end users regarding the Access Certification review will need to be located. These may include notifications about:

• A user's access being under review

• The certification campaign is beginning

• Reminders about a review action (if the end user is also the reviewer)

Navigate to the email customization section in the Okta Admin Console:

1. Go to Customizations > Brands.

2. Select the Brand to be modified (usually the Default one).

3. Click the Emails tab.

4. Browse the list of templates. The following table shows the relevant templates related to Access Certification campaigns.

Modify the Email Template Audience

For each relevant email template, the audience needs to be changed to prevent end users from receiving the notification.

1. Click the Name of a suspected Access Certification-related email template (e.g., the one sent to users whose access is being reviewed).

2. Look for the Audience setting.

3. Click Edit next to the Audience setting.

4. In the edit modal, select:

   • Disabled for all: This completely stops the email from being sent. This is the recommended option if you want to completely suppress end-user emails.

   • Admin only: This will send the notification only to administrators, not end users. This can be useful for testing or logging purposes.

5. Click Update or Save changes. (The button may vary slightly depending on your Okta Experience.)

Repeat for All Relevant Templates

Repeat Step 2 - Modify the Email Template Audience for any other templates that an end user might receive as part of the certification process. Be thorough to ensure no unwanted emails are sent.

NOTE: If you find the ability to customize the specific Access Certification emails directly in the template list to be limited, it might be because some Identity Governance notifications are controlled within the campaign settings themselves or potentially require an Okta Workflows solution for advanced suppression or modification. Always check the campaign creation settings first for any built-in "send email" checkboxes you can uncheck.

 Important Considerations

• Reviewer vs. End-User Emails: Access Certification Campaigns send emails to Reviewers (asking them to perform the review). This guide is specifically for suppressing the emails sent to the reviewers.  The emails to Reviewers (usually managers or application owners) are generally necessary for the campaign to function and may need to be suppressed or customized separately, often within the campaign configuration itself.

• Default vs. Custom Templates: If you customize an Okta email template, you become responsible for providing translations for all supported languages, as the default Okta translations will stop being sent.

• Testing: Always test the campaign in a non-production environment (like a Sandbox org) after making these changes to confirm that the desired end-user emails are successfully suppressed before running the production campaign.

• Delegates should be used in conjunction with adjusting email templates for testing and production rollout of Access Certification campaigns.

Related References

• Corporate blog: Scaling identity lifecycle with Okta Identity Governance

• Guide on using Okta Identity Governance API’s

• Corporate blog: Okta Identity Governance: A Unified IAM and Governance Solution

• School evolving identity threats with confidence

• Understanding Okta Resource Name (ORN)