Identity Manager 9.2.1 - Company Policies Administration Guide

Name of the company policy.

Text field for additional explanation.

Current state of the company policy as a version number. The version number is incremented in One Identity Manager's default installation each time you make a change to the condition.

Specifies whether this is a working copy of the company policy.

Specifies whether the company policy is disabled or not.

Only company policies that are enabled are included in policy checking. Use the Enable policy or Disable policy tasks to enable or disable a company policy. The working copy company policy is always disabled.

Policy group to which the company policy belongs, based on its content. Select a policy group from the menu. To create a new policy group, click . Enter a name and description for the policy group.

Application role whose members are responsible for the company policy, in terms of content.

To create a new application role, click . Enter the application role name and assign a parent application role.

Specifies whether exception approval is permitted when the policy is violated. Assignments that cause the policy to be violated can be approved and issued anyway with this.

Attestation policy to use for attesting objects that violate this company policy.

This field is displayed only when the Attestation Module is installed.

This functionality is used by default in the context of Behavior Driven Governance. For more information about this, see the One Identity Manager Administration Guide for Behavior Driven Governance.

Specifies whether an attestation case is created immediately for each new policy violation. If this option is enabled, assign an attestation policy.

This field is displayed only when the Attestation Module is installed.

This functionality is used by default in the context of Behavior Driven Governance. For more information about this, see the One Identity Manager Administration Guide for Behavior Driven Governance.

Application role, whose members are entitled to grant exception approval for violations to this company policy.

To create a new application role, click . Enter the application role name and assign a parent application role.

Mail template used to generate an email to inform rule supervisors or exception approvers about new policy violations.

Information, which the exception approver may require for making a decision. This advice should describe the risks and side effects of an exception.

Applications role whose members are authorized to approve attestation cases for company policies and policy violations.

To create a new application role, click . Enter the application role name and assign a parent application role.

Specifies whether the company policy a direct relationship to the One Identity Manager data model or not. If this option is set, the Edit condition... button is disabled.

If the option is not set, a condition must be entered that finds all the objects that violate the policy.

Base table referenced by the company policy.

Based on this table, the system determines which objects violate the company policy.

Starts the WHERE clause wizard. Use the WHERE clause wizard to set up a condition that finds all the objects in the base table that violate the company policy. Use the Expert view button to enter the condition in SQL syntax straight away.