Granting exception approval
Assignments that violate rules can be approved in hindsight. To do this, specially authorized identities can grant exception approval.
Prerequisites
-
The Exception approval allowed option is set for the rule.
-
The rule is assigned an application role for exception approvers.
-
Identities are assigned to this application role.
NOTE: If the Exception approval allowed option is not set, unedited rule violations for this rule are automatically denied. Existing exception approvals are withdrawn.
You must also decide whether exception approvers are allowed to approve their own rule violations. By default, an identity that violates a rule is determined to be the exception approver for this rule if they are a member of the Exception approvers application role for the rule. This means they can approve their own rule violations.
To prevent an identity from granting themselves exception approval
-
In the Designer, disable the QER | ComplianceCheck | DisableSelfExceptionGranting configuration parameter.
Identities that violate a rule, are not determined to be exception approvers for this rule violation. Neither the rule violator's main identity nor its subidentities can grant exception approval.
Detailed information about this topic
Exception approval over a limited period
Exception approvals can be set for a limited period of time. To do this, you can specify a validity period for exception approvals on each rule. When the validity period expires, the applicable exception approvals are canceled. A scheduled process plan checks whether an exception approval is still valid.
Once an exception approval has been granted, the expiry date is calculated from the current date and the validity period stored with the rule. You can only change the expiry date for future exception approvals. The expiry date for existing exception approvals does not change.
To set a time limit on exception approvals
-
Enter a validity period for a rule.
-
In the Manager, select the Identity Audit > Rules > Working copies of rules category.
-
Select a working copy from the result list.
-
Select the Change main data task.
-
On the General tab, in the Validity period (max. # days) field, enter the number of days for which exception approvals may apply for this rule.
If the value is 0, the exception approvals have no time limit.
- Save the changes.
-
To transfer the change to the active rule, select the Enable working copy task.
-
In the , configure and enable the Reset exception approval of compliance rule violations schedule.
For more information about setting up schedules, see the One Identity Manager Operational Guide.
Granting exception approvals in the Manager
You use the Web Portal to edit rule violations and grant exception approval, by default. You can, however, grant exception approval in the Manager. To do this, log in as non role-based to the Manager. This function is not available in the Manager for role-based login.
To grant exception approval to identities violating a particular rule
-
In the Manager, select the Identity Audit > Rule violations category.
-
Select the rule violation in the result list.
-
Select the Show rule violations task.
-
Double-click to select the identity you want to grant exception approval to.
This opens the Edit rule violations form.
-
To obtain detailed information about the identity, select the identity.
-
To obtain an overview of the rule violation, select the rule violation.
-
Enter a reason
-
To approve the rule violation for this identity, select Approve exception.
The Approver and Approval date fields and set the Exception is approved and Checked options are preselected.
-
To deny exception approval for this identity, select Deny exception.
The Approver and Approval date fields and the Checked option are preselected.
- Save the changes.
To grant exception approval for rules violated by a specific identity
-
In the Manager, select the Identities > Identities category.
-
Select the identity in the result list.
-
Select the Rule evaluation report.
-
Double-click to select the rule violation for the identity to grant exception approval to.
This opens the Edit rule violations form.
-
To obtain detailed information about the identity, select the identity.
-
To obtain an overview of the rule violation, select the rule violation.
-
Enter a reason
-
To approve the rule violation for this identity, select Approve exception.
The Approver and Approval date fields and set the Exception is approved and Checked options are preselected.
-
To deny exception approval for this identity, select Deny exception.
The Approver and Approval date fields and the Checked option are preselected.
- Save the changes.
Related topics
Notifications about rule violations
After rule checking, email notifications can be sent to exception approvers and rule supervisors through new rule violation. The notification procedure uses mail templates to create notifications. The mail text in a mail template is defined in several languages. This ensures that the language of the recipient is taken into account when the email is generated. Mail templates are supplied in the default installation with which you can configure the notification procedure.
Messages are not sent to the chief approval team by default. Fallback approvers are only notified if not enough approvers could be found for an approval step.
To use email notifications
-
Ensure that the email notification system is configured in One Identity Manager. For more information, see the One Identity Manager Installation Guide.
-
In the Designer, set the QER | ComplianceCheck | EmailNotification configuration parameter.
-
In the Designer, set the QER | ComplianceCheck | EmailNotification | DefaultSenderAddress configuration parameter and enter the sender address used to send the email notifications.
-
Ensure that all identities have a default email address. Notifications are sent to this address. For more information, see the One Identity Manager Identity Management Base Module Administration Guide.
-
Ensure that a language can be determined for all identities. Only then can they receive email notifications in their own language. For more information, see the One Identity Manager Identity Management Base Module Administration Guide.
-
Configure the notification procedure.
Related topics
