Chatee ahora con Soporte
Chat con el soporte

Identity Manager 9.2 - IT Shop Administration Guide

Setting up an IT Shop solution
One Identity Manager users in the IT Shop Implementing the IT Shop Using the IT Shop with the Application Governance Module Requestable products Preparing products for requesting Assigning and removing products Preparing the IT Shop for multi-factor authentication Assignment requests Delegations Creating IT Shop requests from existing user accounts, assignments, and role memberships Adding system entitlements automatically to the IT Shop Deleting unused application roles for product owners
Approval processes for IT Shop requests
Approval policies for requests Approval workflows for requests Determining effective approval policies Selecting responsible approvers Request risk analysis Testing requests for rule compliance Approving requests from an approver Automatically approving requests Approval by peer group analysis Approval recommendations for requests Gathering further information about a request Appointing other approvers Escalating an approval step Approvers cannot be established Automatic approval on timeout Halting a request on timeout Approval by the chief approval team Approving requests with terms of use Using default approval processes
Request sequence
The request overview Requesting products more than once Requests with limited validity period Relocating a customer or product to another shop Changing approval workflows of pending requests Requests for employees Requesting change of manager for an employee Canceling requests Unsubscribe products Notifications in the request process Approval by mail Adaptive cards approval Requests with limited validity period for changed role memberships Requests from permanently deactivated identities Deleting request procedures and deputizations
Managing an IT Shop
IT Shop base data Setting up IT Shop structures Setting up a customer node Deleting IT Shop structures Restructuring the IT Shop Templates for automatically filling the IT Shop Custom mail templates for notifications Product bundles Recommendations and tips for transporting IT Shop components with the Database Transporter
Troubleshooting errors in the IT Shop Configuration parameters for the IT Shop Request statuses Examples of request results

Role types for the IT Shop

Create role types in order to classify roles. You can use role types to limit the approval policies in effect for shelves. To do this, assign role types to shelves and approval policies.

You can also assign role types to shops if you want to apply further criteria to distinguish between shops. Role types for shops do not, however, influence how the approval policies in effect are determined.

To edit a role type

  1. In the Manager, select the IT Shop > Basic configuration data > Role types category.

  2. In the result list, select the role type and run the Change main data task.

    - OR -

    Click in the result list.

  3. Enter a name and detailed description for the role type.

  4. Save the changes.
Related topics

Business partners

In One Identity Manager, you can enter the data for external businesses that could be act as manufacturers, suppliers, or partners. You assign a manufacturer to a service item.

To edit business partners

  1. In the Manager, select the IT Shop > Basic configuration data > Business partners category.

  2. In the result list, select a business partner and run the Change main data task.

    - OR -

    Click in the result list.

  3. Edit the business partner's main data.

  4. Save the changes.

Enter the following data for a company.

Table 63: General main data of a company




Short description of the company for the views in One Identity Manager tools.


Full company name.

Surname prefix

Additional company name.

Short name

Company's short name.


Contact person for the company.


Specifies whether this is a partner company.

Customer number

Customer number at the partner company.


Specifies whether this is a supplier.

Customer number

Customers number at supplier.

Leasing partner

Specifies whether this is a leasing provider or rental firm.


Specifies whether this is a manufacturer.


Text field for additional explanation.

Table 64: Company address




Street or road.



Zip code

Zip code.








Company's telephone number.


Company's fax number.

Email address

Company's email address.


Company's website. Click the button to display the web page in the default web browser.

Functional areas

To analyze rule checks for different areas of your company in the context of identity audit, you can set up functional areas. Functional areas can be assigned to hierarchical roles and service items. You can enter criteria that provide information about risks from rule violations for functional areas and hierarchical roles. To do this, you specify how many rule violations are permitted in a functional area or a role. You can enter separate assessment criteria for each role, such as a risk index or transparency index.

Moreover, functional areas can be replaced by peer group analysis during request approvals or attestation cases.

Example: Use of functional areas

To assess the risk of rule violations for service items. Proceed as follows:

  1. Set up functional areas.

  2. Assign service items to the functional areas.

  3. Specify the number of rule violations allowed for the functional area.

  4. Assign compliance rules required for the analysis to the functional area.

  5. Use the One Identity Manager report function to create a report that prepares the result of rule checking for the functional area by any criteria.

To create or edit a functional area

  1. In the Manager, select the IT Shop > Basic configuration data > Functional areas category.

  2. In the result list, select a function area and run the Change main data task.

    - OR -

    Click in the result list.

  3. Edit the function area main data.

  4. Save the changes.

Enter the following data for a functional area.

Table 65: Functional area properties



Functional area

Description of the functional area

Parent Functional area

Parent functional area in a hierarchy.

Select a parent functional area from the list for organizing your functional areas hierarchically.

Max. number of rule violations

List of rule violation valid for this functional area. This value can be evaluated during the rule check.

NOTE: This property is available if the Compliance Rules Module is installed.


Text field for additional explanation.

Related topics

Chief approval team

Sometimes, approval decisions cannot be made for requests because the approver is not available or does not have access to One Identity Manager tools. To complete these requests, you can define a chief approval team whose members are authorized to intervene in the approval process at any time.

There is a default application role in One Identity Manager for the chief approval team. Assign this application role to all identities who are authorized to approve, deny, cancel requests in special cases, or to authorize other approvers. For more information about application roles, see the One Identity Manager Authorization and Authentication Guide.

Table 66: Default application role for chief approval team



Chief approval team

Chief approvers must be assigned to the Request & Fulfillment | IT Shop | Chief approval team application role.

Users with this application role:

  • Approve through requests.
  • Assign requests to other approvers.

To add members to the chief approval team

  1. In the Manager, select the IT Shop > Basic configuration data > Chief approval team category.

  2. Select the Assign identities task.

    In the Add assignments pane, assign the identities who are authorized to approve all requests.

    TIP: In the Remove assignments pane, you can remove assigned identities.

    To remove an assignment

    • Select the identity and double-click .

  3. Save the changes.
Detailed information about this topic
Documentos relacionados

The document was helpful.

Seleccionar calificación

I easily found the information I needed.

Seleccionar calificación