Applications should be used at least once by at least one OneLogin user within the given time span. You can use a default company policy to identify all OneLogin applications that, according to the change history, have not been used during this time. Exception approvers are informed about the affected applications. Recertification can be used to clarify whether the applications are still needed. This means that users and their managers or target system managers discuss whether the applications are still required. If not, access to unused applications can be subsequently removed, automatically or manually. Default policies must be enabled and configured to meet company requirements.

To find and recertify unused applications

1. (Optional) Configure automatic withdrawal of entitlements.

   Depending on the method used to assign OneLogin user accounts to OneLogin roles (directly, via IT Shop request, through hierarchical roles or system roles), different configuration parameters must be set. For more information about this, see the One Identity Manager Attestation Administration Guide.

2. (Optional) Check whether policy violation notifications and attestation notifications are set up in the attestation case.

   For more information, see the One Identity Manager Company Policies Administration Guide and the One Identity Manager Attestation Administration Guide.

3. (Optional) Assign identities to the Identity & Access Governance | Company policies | Exception approvers application role if they are to be informed about unused OneLogin applications. These identities are allowed to approve exceptions if necessary.

   Assign exception approvers

   1. In the Manager, select the Company Policies > Basic configuration data > Exception approvers category.

   2. Select the Assign identities task.

   3. In the Add assignments pane, add identities.

      TIP: In the Remove assignments pane, you can remove assigned identities.

      To remove an assignment

      • Select the identity and double-click .

   4. Save the changes.

4. Enable the working copy of the Unused OneLogin applications can be removed company policy

   For more information about this, see the One Identity Manager Company Policies Administration Guide.

   Enabling working copies

   1. In the Manager, select the Company policies > Policies > Working copies of policies > Predefined category.

   2. Select the working copy in the result list.

   3. Select Enable working copy.

   4. Confirm the security prompt with Yes.
   5. Enable the original policy. Confirm the prompt with Yes.

   This starts the policy check.

   TIP: If an enabled company policy already exists, you can start the policy check with the Recalculate policy task.

   A predefined schedule starts the policy check once a month.

5. In the Web Portal, edit the Attestation of OneLogin application access attestation policy.

   For more information about this, see the One Identity Manager Web Portal User Guide.

   1. (Optional) To periodically recertify approved unused applications, select an enabled schedule in the Calculation schedule field.

   2. Specify which applications require recertifying. In the Objects to be Attested by this Attestation Policy pane, add at least one other condition.

      Example:

      1. Select the Specific applications condition type and select one of the applications that has been identified as unused by the company policy.

      2. Add another condition with the Unused for x days condition type and enter the number of days after which the application is identified as unused.

      3. Delete the All applications condition.

      If you do not add a condition, attestation cases are created for all the OneLogin application assignments to OneLogin user accounts.

   3. Enable the attestation policy

      • Disable the Disabled check box.

   4. Save the changes.

Procedure

1. In the Manager, verification of the Unused OneLogin applications can be removed company policy is either scheduled or started by the Recalculate policy task.

   • It finds all OneLogin applications where the user account has either not logged in within the specified time period or never logged in.

   • Exception approvers are notified of policy violations via email.

2. In the Web Portal, attestation with the Attestation of OneLogin application access is either scheduled or started manually.

   It finds all OneLogin application assignments to user accounts according to the configured condition.

   Approval sequence:

   1. Is the user account linked to an identity?

      • If not, the assignment is submitted to the target system managers for attestation.

   2. The linked identity confirms whether the assigned application is required.

   3. The manager of the linked identity decides whether the assignment stays.

   4. If attestation was denied in an approval level, automatic removal of the assignment is reviewed. This finds all OneLogin roles used to assign applications to the user account.

      • If no other applications are assigned to a role, automatic withdrawal of this role is initiated. This removes the assignment of the role to the user account and provisions the change in the target system, thus removing the entitlement for using the application from the OneLogin user.

        With the subsequent synchronization, assignment of the application to the user account is marked as pending or deleted in the One Identity Manager database, depending on the configuration of the synchronization. Run a full target system synchronization to irrevocably delete pending assignments.

   5. If the application is assigned directly to the user account or access to multiple applications is granted through a OneLogin role, the attestation case is submitted to the target system managers for final processing.

      • If the target system managers deny attestation, they must ensure that the assignments are removed manually.

If the manager or target system managers have approved the attestation, the assignment stays and is submitted for recertification again by the next scheduled check.

Related topics

• Behavior Driven Governance for OneLogin
• Prerequisites for automatic withdrawal of unused OneLogin applications
• Identifying unused access to OneLogin applications
• Assigning OneLogin applications to OneLogin roles