A default sample is provided for attesting memberships in system entitlements after organizational changes. This sampling data is determined automatically. This identifies all individuals whose manager or primary department, cost center, or business role assignment has changed since the previous attestation. All memberships are attested whose user accounts are associated with these individuals.
To use attestation of memberships in system authorizations after organizational changes
-
In the Designer, set the QER | Selections | PersonOrganizationalChanges configuration parameter.
-
Create a schedule and assign it to the System entitlement memberships after organizational changes attestation policy. By doing this, you replace the schedule assigned by default.
Once an attestation run is complete, the sampling data is deleted. As soon as an individual's organizational data changes, they are included in the sample. This ensures that the sample always includes only those individuals whose organizational data has changed since the previous attestation.
TIP: Sampling data is calculated by the QER_Person_Add_to_PickCategory_Organizational_Changes process. You can customize the generating condition of this process.
There is a default sample, Individual selection of identities, provided for attesting identities. This sample is used for the Identity attestation policy collection. The sampling data must be assigned manually.
Different attestation policies can be combined into a collection allowing the attestations to start simultaneously. For example, this can be used in the context of an audit, when different attestations are run that have related content.
Related attestation policies can be grouped together into policy collections. Policy collections must be assigned a schedule for running these attestation policies. Use a sample to limit the set of objects to attest for all assigned attestation policies.
The following applies:
-
An attestation policy can be assigned to only one policy collection.
-
Attestation policies that belong to a policy collection cannot be started separately.
-
When samples are attested, the same sample is used for all the attestation policies that belong to one policy collection.
Example of a policy collection
The following properties of all identities in department D are going to be attested:
These attestations must always be performed simultaneously.
The following objects must be created for this purpose:
-
Attestation procedure for the Person, PersonInOrg, UNSAccount, UNSAccountInUNSGroup tables
-
A schedule
-
A sample the find all identities assigned to department D
-
A policy collection that uses the schedule and sample
-
Attestation policies that use the attestation procedures and the policy collection
To run different attestations together, create a policy collection and assign it to all the attestation policies that you want to start collectively.
To delete a policy collection
-
In the Manager, select the Attestation > Policy collections category.
-
Click 
in the result list.
-
Edit the main data of the policy collection.
- Save the changes.
To edit a policy collection
-
In the Manager, select the Attestation > Policy collections category.
-
In the result list, select the policy collection and run the Change main data task.
-
Edit the main data of the policy collection.
- Save the changes.
Detailed information about this topic
