Overview

Applies To

• Access Certifications

Solution

  To create a new Access Certification:

1. Log into Okta as an Administrator with the Access Certification role or Super Admin.
2. Select Identity Governance menu.
3. Select Access Certification application.
4. Locate and click the blue + Create campaign button.
5. Select User Campaign
6. Fill out each step to create a campaign.

Step 1: General

Create campaign screen

1. Enter the name of the campaign.
2. Enter an optional description.
3. The description is visible to the reviewer and can be used as part of a verification rule.
4. Select the start date/time, and time zone.
5. Select the duration of time the campaign will run.  Note:  A duration of at least 8 days is required as a minimum to support multiple levels of reviewers.
6. Lastly, select Make this recurring and set up those related options as needed if desired.
7. Click the Next button.

Step 2: Users

Option 1: Specific groups

1. Select Specific groups from the dropdown
2. Use the Select groups box to pick groups from within your Okta tenant.
3. Click Next

Option 2: Individual users

1. Select Individual Users
2. Use the Select users box to search and select users from within your Okta tenant.
3. Click the Next button.

Option 3: Custom (Okta Expression Language)

1. Select Custom (Okta Expression Language)
2. Use the Scope Users box to type in an Okta Expression to identify users based on Okta Expression Language. Feel free to click Sample expressions or the Okta Expression Language guide as a reference.
3. Click Next.

Step 3: Resources

1. Select the Resource Scope related to the users.  Your options are:
   1. All apps and groups assigned to user in scope
   2. All apps assigned to users in scope
   3. All groups assigned to users in scope

2. Check any of the options above based upon what you selected for the scope.  
   1. Only include individual assigned applications should be selected if a user could be assigned directly and group assigned.  Eliminating duplication entries.
   2. Only include individually assigned groups should be selected if you don’t want to review birthright access based upon Group Rules.
3. Exclusions should be selected and included based upon the scope of your targeted campaign.
4. Click Next.

Step 4: Reviewer  

1. Select the First-level reviewer by clicking the appropriate box on the screen.  

NOTE: Options applicable to the reviewer that was selected will be displayed.  Clicking the Pencil icon to the right of the reviewer type will bring you back to the previous selection screen.  

2. Select Preview Reviewer and verify your settings.

1. Click + Add level
2. Follow the same steps for Single Level reviewer above except the Reviewer type cannot be reused if selected in the first level review.  
3. Select Preview 2nd level Reviewer and verify your settings.

4. Select the option for which decision go to the second level

These settings allow you to define which decisions may or may not be reviewed by the second-level reviewer and when the second-level review should start.  

Second-level reviewers will have visibility into only items moving onto the second level. When that second-level reviewer should see all items, it’s recommended to pass on both approved and revoked decisions.

NOTE: Reviews less than 8 days will not support a 2nd level review flow. Items that have not been completed by the first-level reviewer before the second-level review begins will be marked as overdue, and it’s recommended to enable the overdue notifications so that these reviewers know and complete their reviews quickly.

5. Expand the Notification settings section 

6. Choose the notifications you want to be sent as part of this campaign.
   1. If you decide to go back to a Single level review for the campaign, simply click the Remove Level button on the screen.
7. Click the Next button.

Step 5: Remediation

1. Select the appropriate remediation steps by selecting the appropriate radio button.

2. Click the Schedule Campaign button to finish creating the campaign.  
3. From there you can wait until the time scheduled to start or as an Admin you can Launch, Edit or Delete a scheduled campaign.

• Customers that have many users changing departments every week
• Customers using HR as a Source Integration, when changes occur with department changes they can recertify access for those users when it happens.

• Set up a campaign where the target users are a group, e.g. "User Department Changes" that recurs every week
• Set up a workflow triggered by the Okta User Profile Change and if the department changed, add the user to that "User Department Change" group
• Set up a workflow triggered by the campaign launching, and remove all users from that group

Related References

• Access Certification documentation
• Multi-level reviewers