By David Edwards, Okta Senior Product Acceleration Specialist
 

Overview

The ability to build and run access certification campaigns against resources in Okta (groups and applications) has been in Okta Identity Governance (OIG) since it was released. In June, User Campaigns was added to address User Access Review requirements.



 

Whereas the resource campaigns are focused on who has access to a set of resources, the user campaign is focused on what access (groups and/or resources) a user has. Resource campaigns are more useful to service owners or those concerned with compliance. User campaigns are more useful to managers who need to keep track of what access their people have.

The mechanisms and interfaces for user campaigns are the same as for resource campaigns, so this is an evolution of OIG Access Certifications (as will be Entitlement Campaigns when the Entitlements features are rolled out). This means no new training for reviewers, and the same management mechanisms used today will also work for user campaigns.

There is also a video walkthrough of this on the Okta YouTube channel.

In this article, we will walk through creating and running a User Campaign.
 

SETTING UP A USER CAMPAIGN

The setup steps are similar to a resource campaign, with the wizard-like UI walking through the general setup, user selection, resource selection, reviewer selection, and remediation action steps. The following sections will highlight the differences (assuming you’re familiar with setting up Access Certification Campaigns).

You begin by selecting User Campaign from the pulldown under the Create Campaign button (shown above).
 

General Set Up

The General page is the same as for every campaign – name and description, and execution start and duration.



 

Users Selection

The Users page is new for this campaign type. This is the page where you specify the users that will be the subject of this campaign.

You can select to specify groups of users (all users in one or more groups), or a specific user or use some Okta Expression Language (OEL) to determine the user(s).


 

The second field will change depending on the selection of the first. For example, selecting Individual users will change the second field to Select users.


 

If you select to use OEL you will get a text field for the expression language plus links to samples and the documentation (as you would with a resources campaign).

This might be useful if you want to select a set of users based on a User Profile attribute, like review access to all users in a department or office location.
 

Resources Step

With the user(s) selected, you need to define what Resources to include. You can select all apps and groups, all apps or all groups.


 

There are four checkboxes you can select or not:

• Only include individually assigned apps – you can either see all apps for the user (i.e., assigned directly or via a group assignment) or only those assigned directly
• Only include individually assigned groups – you can see all group memberships (i.e., manually assigned or assigned automatically through a group rule) or only those assigned manually
• Exclude specific apps from the campaign – list those to exclude
• Exclude specific groups from the campaign – list those to exclude

By default, you will see everything, but some campaigns may need the selection of some of these options.
 

Reviewer Step

The Reviewer page is the same as for any other campaign. You can specify multiple levels of reviewers and also when notifications are sent.


 

Some options, like Group Owner, aren’t available as they don’t apply to user campaigns.
 

Remediation Step

The Remediation page and options are the same as for any other campaign.

Even though the campaign is presenting resource assignments by user, the outcome is the same – users retain or lose the assignment based on the reviewer selecting Approve or Revoke when reviewing, and these options control what occurs.
 

RUNNING A USER CAMPAIGN

Running the campaign is exactly the same as with a resource campaign – it is launched then reviewers review access until the campaign finishes.
 

Launching the Campaign

With the user campaign defined, it will launch on schedule or can be manually launched immediately.

The administrator can see details of the campaign – a summary at the top and the review details (items) at the bottom.


 

The reviewers will get a notification of the campaign being launched.
 

Campaign Review

The reviewer, such as the user’s manager, will see the new campaign in their list of open campaigns.


 

Opening the campaign, they will see the summary information and the list of items to be reviewed. This is the same as for any resource campaign.

As with the resource campaigns, the reviewer can see the details of a specific user-resource assignment by clicking on the row.



 

The reviewer would run through all the assigned items and Approve, Revoke or Reassign as they would for a resource campaign.
 

Monitoring, Managing, and Reporting

As with resource campaigns, the progress can be monitored in the Admin Console, review events will be sent to the Okta System Log (and can trigger automation in Workflows), and the campaign information will be available in the Access Certification Campaigns reports.
 

CONCLUSION

Adding user campaigns to Okta Identity Governance Access Requests for User Access Review requirements represents an evolution, not a revolution. The concepts and user interface are the same, just with a focus on users rather than resources. It represents a significant improvement in functionality with little incremental change to those using it.

Related References

• Access Certification - Campaigns
• To view feature requests and upvote product enhancement requests, please visit Okta Ideas.

Looking for Okta Identity Governance help? Visit the Okta Identity Governance Product Hub or schedule Office Hours with the Okta Identity Governance team.