Identity Manager On Demand Hosted - IT Shop Administration Guide

Preprocessor relevant configuration parameter to control the component parts for the IT Shop. If the parameter is set, the IT Shop components are available. Changes to this parameter require the database to be recompiled.

If you disable the configuration parameter at a later date, model components and scripts that are not longer required, are disabled. SQL procedures and triggers are still carried out. For more information about the behavior of preprocessor relevant configuration parameters and conditional compiling, see the One Identity Manager Configuration Guide.

This configuration parameter defines whether employees are removed from all customer nodes when they are permanently disabled.

This configuration parameter controls automatic approval of IT Shop requests over several approval levels.

General configuration parameter that defines automatic assignment of system entitlements to the IT Shop.

Preprocessor relevant configuration parameter for automatically adding Azure Active Directory service plans to the IT Shop. If the parameter is set, all service plans are automatically assigned as products to the IT Shop. Changes to this parameter require the database to be recompiled.

If you disable the configuration parameter at a later date, model components and scripts that are not longer required, are disabled. SQL procedures and triggers are still carried out. For more information about the behavior of preprocessor relevant configuration parameters and conditional compiling, see the One Identity Manager Configuration Guide.

In effect in module: Azure Active Directory Module

List of all Azure Active Directory service plans that must not be automatically assigned to the IT Shop. Each entry is part of a regular search pattern and supports regular expression notation.

Preprocessor relevant configuration parameter for automatically adding Azure Active Directory groups to the IT Shop. If the parameter is set, all groups are automatically assigned as products to the IT Shop. Changes to this parameter require the database to be recompiled.

If you disable the configuration parameter at a later date, model components and scripts that are not longer required, are disabled. SQL procedures and triggers are still carried out. For more information about the behavior of preprocessor relevant configuration parameters and conditional compiling, see the One Identity Manager Configuration Guide.

In effect in module: Azure Active Directory Module

List of all Azure Active Directory groups that must not be automatically assigned to the IT Shop. Each entry is part of a regular search pattern and supports regular expression notation.

Example:

.*Administrator.*|Exchange.*|.*Admins|.*Operators|IIS_IUSRS

Preprocessor relevant configuration parameter for automatically adding Azure Active Directory subscriptions to the IT Shop. If the parameter is set, all subscriptions are automatically assigned as products to the IT Shop. Changes to this parameter require the database to be recompiled.

If you disable the configuration parameter at a later date, model components and scripts that are not longer required, are disabled. SQL procedures and triggers are still carried out. For more information about the behavior of preprocessor relevant configuration parameters and conditional compiling, see the One Identity Manager Configuration Guide.

In effect in module: Azure Active Directory Module

List of all Azure Active Directory subscriptions that must not be automatically assigned to the IT Shop. Each entry is part of a regular search pattern and supports regular expression notation.

Preprocessor relevant configuration parameter for automatically adding Active Directory groups to the IT Shop. If the parameter is set, all groups are automatically assigned as products to the IT Shop. Changes to this parameter require the database to be recompiled.

If you disable the configuration parameter at a later date, model components and scripts that are not longer required, are disabled. SQL procedures and triggers are still carried out. For more information about the behavior of preprocessor relevant configuration parameters and conditional compiling, see the One Identity Manager Configuration Guide.

In effect in modules: Active Directory Module, Active Roles Module

List of all Active Directory groups that must not be automatically assigned to the IT Shop. Each entry is part of a regular search pattern and supports regular expression notation.

Example:

.*Administrator.*|Exchange.*|.*Admins|.*Operators|IIS_IUSRS

The configuration parameter specifies whether the template should be applied to the ADSGroup.DisplayName column.

Preprocessor relevant configuration parameter for automatically adding Exchange Online mail-enabled distribution groups to the IT Shop. If the parameter is set, all distribution groups are automatically assigned as products to the IT Shop. Changes to this parameter require the database to be recompiled.

If you disable the configuration parameter at a later date, model components and scripts that are not longer required, are disabled. SQL procedures and triggers are still carried out. For more information about the behavior of preprocessor relevant configuration parameters and conditional compiling, see the One Identity Manager Configuration Guide.

In effect in module: Exchange Online Module

List of all Exchange Online mail-enabled distribution groups that must not be automatically assigned to the IT Shop. Each entry is part of a regular search pattern and supports regular expression notation.

Example:

.*Administrator.*|Exchange.*|.*Admins|.*Operators|IIS_IUSRS

Preprocessor relevant configuration parameter for automatically adding Office 365 groups to the IT Shop. If the parameter is set, all groups are automatically assigned as products to the IT Shop. Changes to this parameter require the database to be recompiled.

If you disable the configuration parameter at a later date, model components and scripts that are not longer required, are disabled. SQL procedures and triggers are still carried out. For more information about the behavior of preprocessor relevant configuration parameters and conditional compiling, see the One Identity Manager Configuration Guide.

In effect in module: Exchange Online Module

List of all Office 365 groups that must not be automatically assigned to the IT Shop. Each entry is part of a regular search pattern and supports regular expression notation.

Preprocessor relevant configuration parameter for automatically adding Microsoft Teams teams to the IT Shop. If the parameter is set, all teams are automatically assigned as products to the IT Shop. Changes to this parameter require the database to be recompiled.

If you disable the configuration parameter at a later date, model components and scripts that are not longer required, are disabled. SQL procedures and triggers are still carried out. For more information about the behavior of preprocessor relevant configuration parameters and conditional compiling, see the One Identity Manager Configuration Guide.

In effect in module: Microsoft Teams Module

List of all Microsoft Teams teams that must not be automatically assigned to the IT Shop. Each entry is part of a regular search pattern and supports regular expression notation.

Preprocessor relevant configuration parameter for automatically adding PAM user groups to the IT Shop. If the parameter is set, all user groups are automatically assigned as products to the IT Shop. Changes to this parameter require the database to be recompiled.

If you disable the configuration parameter at a later date, model components and scripts that are not longer required, are disabled. SQL procedures and triggers are still carried out. For more information about the behavior of preprocessor relevant configuration parameters and conditional compiling, see the One Identity Manager Configuration Guide.

In effect in module: Privileged Account Governance Module

List of all PAM user groups that must not be automatically assigned to the IT Shop. Each entry is part of a regular search pattern and supports regular expression notation.

Example: .*Administrator.*|.*Admins|.*Operators

Preprocessor relevant configuration parameter for automatically adding SharePoint groups to the IT Shop. If the parameter is set, all groups are automatically assigned as products to the IT Shop. Changes to this parameter require the database to be recompiled.

If you disable the configuration parameter at a later date, model components and scripts that are not longer required, are disabled. SQL procedures and triggers are still carried out. For more information about the behavior of preprocessor relevant configuration parameters and conditional compiling, see the One Identity Manager Configuration Guide.

In effect in module: SharePoint Module

List of all SharePoint groups that must not be automatically assigned to the IT Shop. Each entry is part of a regular search pattern and supports regular expression notation.

Example:

.*Administrator.*|Exchange.*|.*Admins|.*Operators|IIS_IUSRS

General configuration parameter for dealing with role assignments that are modified by data import. Removal of role memberships can be challenged with the help of temporary requests.

This configuration parameter contains the validity period (in days) of temporary requests for challenged role memberships.

Temporary requests of department memberships are supported.

Temporary membership of the previous department is requested if changes are made to the primary membership in departments.

This configuration parameter contains the product node that is assigned to the requested assignment resource.

Temporary requests of location memberships are supported.

Temporary membership of the previous location is requested if changes are made to the primary membership in locations.

Temporary requests of business role memberships are supported.

Temporary membership of the previous business role is requested if changes are made to the primary membership in business roles.

Temporary requests of cost center memberships are supported.

Temporary membership of the previous cost center is requested if changes are made to the primary membership in cost centers.

This configuration parameter controls approval of a request the moment is it added.

Sender's default email address for sending automatically generated notifications about requests. Replace the default address with a valid email address.

Syntax:

sender@example.com

Example:

NoReply@company.com

You can enter the sender's display name in addition to the email address. In this case, ensure that the email address is enclosed in chevrons (<>).

Example:

One Identity <NoReply@company.com>

Preprocessor relevant configuration parameter for controlling model components for delegation and role membership. Changes to the parameter require recompiling the database. If the parameter is set, delegation components are available.

If you disable the configuration parameter at a later date, model components and scripts that are not longer required, are disabled. SQL procedures and triggers are still carried out. For more information about the behavior of preprocessor relevant configuration parameters and conditional compiling, see the One Identity Manager Configuration Guide.

This configuration parameter specifies whether closed requests are deleted.

This configuration parameter specifies the maximum retention time (in days) of canceled requests.

This configuration parameter specifies the maximum retention time (in days) of denied requests.

This configuration parameter specifies the maximum retention time (in days) of canceled requests.

The configuration parameter specifies whether requests of limited validity are unsubscribed or canceled once their limit is exceeded. If the parameter is set and the request has the status Assigned or Renewal, the request is unsubscribed if not other request exist for the product that is currently in effect. Expired requests with the status Unsubscription and Unsubscribed are no longer taken into account. Expired requests with the status approved, pending, request are canceled. If the parameter is not set, the request will be canceled in any case.

Defines behavior when checking the validity period of new requests.

This configuration parameter specifies which requests are checked.

This configuration parameter specifies whether validity periods of two or more pending requests can overlap.

This configuration parameter specifies how many GenProcIDs should be generated for a shopping cart's requests. If the configuration parameter is not set, a separate GenProcID is generated for each shopping cart request.

Maximum number of product nodes that can be generated or deleted by a DBQueue Processor run. Once this number is exceeded, a task for generating the rest of the nodes is queued in the DBQueue.

Name of the user account for authenticating the mailbox used for approval by mail.

Exchange Online application ID for authentication with OAuth 2.0. If the value is not set, the Basic or the NTML authentication method is used.

Specifies the way emails are deleted from the inbox.

Domain of the user account for authenticating the mailbox used for approval by mail.

URL of the Microsoft Exchange web service for accessing the mailbox. If this is not given, AutoDiscover mode is used to detect the URL.

Microsoft Exchange mailbox to which approvals by mail are sent.

Password of the user account for authenticating the mailbox used for approval by mail.

This mail template is used to send a notification with an answer to a question from an approver.

This mail template is used to notify approvers that an approval decision has been made for the step they added.

This mail template is used to notify approvers that an approval decision has been made for the step they delegated.

Mail template used for requests made through "Approval by mail".

This mail template is used to send a notification with a question from an approver to an employee.

This mail template is used for generating an email when there are pending requests for an approver. If this configuration parameter is not set, a "Mail template demand" or "Mail template reminder" for single approval steps can be entered to send an email for each request. If this configuration parameter is set, single mails are not sent.

This configuration parameter specifies how pending orders are handled when an approval, change, or cancellation workflow is reassigned to the approval policy.

This configuration parameter specifies how pending orders are handled when the approval workflow is changed.

This configuration parameter allows automatic approval of requests by peer group analysis.

This configuration parameter defines a threshold for peer group analysis between 0 and 1. The default value is 0.9.

This configuration parameter specifies whether functional areas should be take into account in peer group analysis. If the parameter is set, the request is only approved if the request's recipient and the requested product belong to the same functional area.

This configuration parameter specifies whether employees can be added to the peer group who have the same manager as the request's recipient.

This configuration parameter determines whether employees who are primary members of the primary department of the request's recipient are included in the peer group.

This configuration parameter determines whether employees who are a secondary members of the primary or secondary department of the request's recipient are included in the peer group.

This configuration parameter specifies whether the employee that triggered the request may approve it.

This configuration parameter specifies whether the employee for whom the request was triggered, may approve it.

This configuration parameter specifies whether the employee who initiated the request can issue exception if compliance rules are violated by the request.

This configuration parameter specifies whether the employee for whom the request was initiated can issue exception if compliance rules are violated by the request.

This configuration parameter specifies, which approval steps are recalculated if the IT Shop approver must be recalculated.

If an employee leaves a customer node, all assigned requests are canceled and assignment requests are converted to direct assignments. If this parameter is set, then assignment requests can be transferred to the manager or central approver group, and to the UID_PersonFallback if necessary. (Note: These employees must have approval authorization for this assignment).

UID_Person is an employee who is set as the fallback if no other request recipient can be found for an assignment request. This employee must be a customer in all shops in which assignments can be requested.

This configuration parameter specifies if approval granted by one approver to all approval steps of an approval process is transferred. If the parameter is set, the current step is approved if an approval step is reached in the approval process for which an employee with approval authorization has already granted approval. If the parameter is not set, the approver must separately approve each step for which they have approval authorization. If approval has not been granted, it is not transferred.

This configuration parameter specifies whether request templates can be used in the IT Shop.

This configuration parameter specifies whether public request templates are automatically labeled as "shared" or whether they have to be manually shared by a manager.

This configuration parameter specifies whether the manager of an organization or business role can view completed assignment requests for their organization or business role.

If this parameter is not set, the manager can only view open assignment requests for their organization or business role.

Preprocessor relevant configuration parameter for controlling the database model components for the Shelf Filling Wizard. Changes to the parameter require recompiling the database. Shelf templates can be used. Changes to this parameter require the database to be recompiled.

If you disable the configuration parameter at a later date, model components and scripts that are not longer required, are disabled. SQL procedures and triggers are still carried out. For more information about the behavior of preprocessor relevant configuration parameters and conditional compiling, see the One Identity Manager Configuration Guide.

This configuration parameter specifies whether the recursive deletion is allowed from shelf templates. This configuration parameter is disabled by default.

Excludes rule violators from becoming exception approvers. If this parameter is set, no one can approve their own rule violations.

IT Shop properties for the compliance rule are visible and can be edited.

This configuration parameter specifies whether classic Starling Two-Factor Authentication integration is supported.

This configuration parameter specifies whether One Identity Starling Cloud is supported.

Initiate your subscription within your One Identity on-prem product and join your on-prem solutions to our One Identity Starling cloud platform. Giving your organization immediate access to a number of cloud-delivered microservices, which expand the capabilities of your One Identity on-prem solutions. We will continuously make available new products and features to One Identity Starling. For a free trial of our One Identity Starling offerings and to get the latest product feature updates, visit cloud.oneidentity.com.

This configuration parameter defines whether requests can be approved by Starling 2FA app.

This configuration parameter specifies the timeout in seconds after which approval by Starling 2FA app expires.

General configuration parameter for Web Portal settings.

Web Portal URL. This address is used in mail templates to add hyperlinks to the Web Portal.

This configuration parameter contains the display name of the Web Portal. This name is used in mail templates.

Password Reset Portal URL. This address is used to navigate within the Web Portal.

This configuration parameter specifies whether Web Portal users can change their default workdesk. If the configuration parameter is set, users can relocate their workdesk through the Web Portal.

This configuration parameter specifies whether pictures of products are displayed in the Web Portal.

Data for the signature in email automatically generated from mail templates.

Signature under the salutation.

Company name.

Link to the company's website.

Display text for the link to the company's website.

If this configuration parameter is set, a process monitoring entry (DialogProcess table) is created when the request is created.

When this configuration parameter is set, changes to individual values are logged and shown in the process view. Changes to the parameter require recompiling the database.

If you disable the configuration parameter at a later date, model components and scripts that are not longer required, are disabled. SQL procedures and triggers are still carried out. For more information about the behavior of preprocessor relevant configuration parameters and conditional compiling, see the One Identity Manager Configuration Guide.

If this configuration parameter is set, the GenProcID of an IT Shop request is retained for the entirety of the approval process. If the configuration parameter is not set, a new GenProcID is used for each approval decision.