Role assignment and responsibilities can be temporarily delegated to others. Thereby, a distinction is made between single delegations and deputizing.

• Deputize: Delegate all your responsibilities for a defined area to a deputy. The following areas can be selected:

  • Approval authorization for requests

    Once an identity is determined as the approver for requests, their deputy is added as an additional approver.

  • Exception approval requests violate the rules

    Once an identity is determined as the exception approver for requests, their deputy is added as an additional exception approver.

  • Approval authorization in attestation cases

    Once an identity is determined as the attestor, their deputy is added as an additional attestor.

  • Managers of identities

    The deputy of an identity's manager can also approve managerial tasks. For example, a deputy can initiate requests for employees.

  • Manager of all roles of a role class

    The deputy of a hierarchical roles manager can also approve all managerial tasks. For example, a deputy can initiate assignment requests for a business role.

    You can delegate responsibility for the following role classes:

    • Departments

    • Cost centers

    • Locations

    • Selected business roles

    • IT Shop structures (owner)

  Example: During their vacation, user A delegates any responsibilities as manager of business roles with the "Projects 2222" role class and approval authorization for requests to their deputy, user B.

  • A deputization, unlike single delegation, cannot be delegated further.

  • A single responsibility that was acquired via deputization can be delegated further by single delegation. (Example: User B delegates their responsibility for the "Projects 2222: Role B" business role to User E.)

  • An identity that is connected as a main or sub-identity cannot become a delegate nor can deactivated identities.

• Single delegation: Delegate your responsibility for a specific role or your memberships in a specific business or application role to any given identity.

  Example: User 1 delegates their membership in the "Project 2222-A" business role to user 2.

  • Single delegations can be delegated further.

Delegations are automatically approved after a compliance check. They can be canceled and deleted. For more information about delegating tasks, see the One Identity Manager Web Portal User Guide.

Delegations are revoked when the valid-until date is exceeded, the delegate is deleted from the customer node, or the deputy is deactivated.

Detailed information about this topic

• Preparing single delegations
• Standard products for delegation
• Allowing delegation approvals
• Deleting request procedures and deputizations