Identity Manager 8.0 - Web Portal User Guide

Attestors

in the System entitlements menu, you can change attestors for an Active Directory groups.

But you can also create a new attestor or move responsibilities.

To assign an attestor to a Active Directory group

1. Open the menu System Entitlements and select an Active Directory group.
2. Select Attestor.
3. Perform one of the following tasks.
   1. Click Change.
   2. Select another attestor from the list.

      - OR -

   3. Click New.
   4. Enter a name for the new application role and a reason for creating it.
   5. Select an attestor using the Assign link and the new application role using the Attestor menu.

Usage

Roles are used to help manage assignments to employees. For example, instead of assigning many resources separately to an employee, you can add them to a role that inherits the proper assignments from a role class. A role class is the highest level, and roles can be nested in it. In the Usage view, you see all role members that can be member of the selected entry. If you select a role class, you can view all the members with a role.

Information is displayed as a hierarchical chart, so you can drill in and see the role inheritance.

To view employee assignments of a role class

1. Perform one of the following tasks.
   1. Open the System Entitlements menu and select a system entitlement.
   2. Open the Business Roles menu and select a business role.
   3. Open the System Roles menu and select a system role.
   4. Open the Department menu and select a department.
   5. Open the Cost Center menu and select a cost center.
   6. Open the Location menu and select a location.

1. Select Usage.
2. Select a role class.

   This displays employee assignments for the selected role class.

3. Open the legend for the selected role class with More information.

Child Groups

Some groups own group memberships. The Child groups view is only available for these groups. Not only do you have an overview of existing group memberships, you can also add them. For this, you assign a child group to the selected group. The following groups can, for example, own group memberships or allow assignment of child groups.

• Active Directory groups
• SAP groups

In the following step-by-step, adding a group membership is described on the basis of an Active Directory group.

To assign a child group to a group

1. Open the System Entitlements menu and select an Active Directory group.
2. Select Child groups and click new child group.
3. Select a child group using Assign and save it.

   The selected child group is displayed in the Child groups view.

Business Roles

Business roles are defined based on the resources needed to perform a particular function. The roles that appear on this list are roles that you are responsible for administering.

For each business role you own, you may be able to:

• View information about the business role, members and entitlements, risk assessment and rule violations, attestation cases and usage of various role classes.
• Change the properties of the role.
• Add members to the role.
• Add entitlements to the role.
• View statistics.

Some functions have already been described in other menus. You can find all the executable functions in the menu listed under "Detailed information about this topic".

To open the "Business Roles" menu

• Open the menu Responsibilities | My Responsibilities and click Business Roles.

Detailed information about this topic

• New Business Roles
• Restoring Deleted Roles
• Master Data
• Adding Memberships
• Deleting Memberships
• Adding Entitlements
• Deleting Entitlements
• Splitting a Role
• Viewing Risk Indexes
• Splitting a Role
• Compare and Merge
• History
• Timeline
• Status comparison
• Restoring to a Historical Status
• Usage
• Viewing Details
• Attestations
• Statistics