Displaying approvable rule violations
You can display rule violations that you can approve. In doing so, you can additionally display rule violations that have already have an approval decision.
To display rule violations
-
In the menu bar, click Compliance > My Actions.
-
On the My Actions page, click Pending Rule Violations.
This opens the Pending Rule Violations page (see Pending rule violations (page description)) and displays all rule violations for which no approval decision has yet been made.
-
(Optional) To display rule violations that have already been approved or denied, click 
(Reset filter: decision status).
-
(Optional) To display details of the identity involved in a rule violation, take the following actions:
-
In the list, click the rule violation.
-
In the details pane, click the identity's name.
Related topics
Approving and denying rule violations
As exception approver, you can grant or deny approval to rule violations. If you grant approval to a rule violation, it is considered to be a exception approval.
To make an approval decision about a rule violation
-
In the menu bar, click Compliance > My Actions.
-
On the My Actions page, click Pending Rule Violations.
-
On the Pending Rule Violations, perform one of the following actions:
-
(Optional) To set an approval deadline, perform the following actions:
-
In the list, click the role violation for which you want to set an approval deadline.
-
In the details pane, enter the Valid until date.
-
Click Next.
-
(Optional) On the Exception Approvals page, perform the following actions:
-
For approved rule violations:
-
To provide a reason for all approved rule violations, enter the reason in the Reason for approvals field.
-
To use a predefined standard reason for all approved rule violations, select the reason in the Standard reason list.
-
For denied rule violations:
-
To provide a reason for all denied rule violations, enter the reason in the Reason for approvals field.
-
To use a predefined standard reason for all denied rule violations, select the reason in the Standard reason list.
-
To provide an individual reason for an approval decision, click Enter a reason and enter your reason.
TIP: By giving reasons, your approvals are more transparent and support the audit trail.
NOTE: For more detailed information about standard reasons, see the One Identity Manager Compliance Rules Administration Guide.
-
Click Save.
(Optional) If the approval requires multi-factor authentication, you are prompted to enter a security code. It may take a few minutes before the prompt appears. Perform one of the following actions:
-
Click Login with the Starling 2FA app and follow the app instructions on your mobile phone.
-
Click Send SMS or Phone call, enter the security code, and click Next.
Related topics
Resolving rule violations
You can resolve compliance rule violations that you manage. Rule violations are caused by permissions, so you have the option to remove permissions when you want to resolve one.
Permission assignments play and important role when editing rule violations. For example, permissions assigned through a dynamic role cannot be removed.
The following consequences may result from removing permissions:
Table 21: Removing assigned permissions
|
Direct assignment |
Direct assignment is deleted when the entitlement is removed. |
|
Inherited assignment |
In the case of inherited permissions, there is an option provided to withdraw role membership from the identity. |
|
Dynamic assignment |
Permissions assigned through a dynamic role cannot be removed. |
|
Assignment by request |
If permissions were assigned through a request, the request ends if the permissions are removed. |
|
Primary assignment |
If permissions were assigned through a primary membership, the identity of the primary membership can be optionally revoked if the permissions are removed. |
To resolve a rule violation
-
In the menu bar, click Compliance > My Actions.
-
On the My Actions page, click Pending Rule Violations.
-
On the Pending rule violations page, click the rule violation you would like to resolve.
-
In the details pane, click Resolve.
This opens the Resolve a rule violation dialog and with more details about the rule violation and the permissions that lead to the rule violation.
-
Select the check box next to the permission that you want to be revoked.
-
Click Next.
-
In the Verify step, check the changes to be made.
TIP: The Action column show the consequences of revoking.
-
Click Next.
-
In the Loss of entitlements step, check which permissions are to be revoked to avoid losing permissions accidentally.
-
Click Next.
All permissions that were displayed for resolving the rule violation are withdrawn from the identity.
Related topics
Displaying rule violation history
To monitor your approval decisions about rule violations, you can see the approval decisions.
To display the rule violations history
-
In the menu bar, click Compliance > My Actions.
-
On the My Actions page, click Rule Violation History.
This opens the Rule Violation History page (see Rule Violation History (page description)).
Related topics
(Approve) next to the rule violation you want to approve.
(Deny) next to the rule violation you want to deny.