Compliance rules that are violated generate rule violations. Rule violations may be approved as an exception. Rule violations that you can approve are displayed on the Pending Rule Violations page (see Pending rule violations (page description)).
Compliance rules that are violated generate rule violations. Rule violations may be approved as an exception. Rule violations that you can approve are displayed on the Pending Rule Violations page (see Pending rule violations (page description)).
You can display rule violations that you can approve. In doing so, you can additionally display rule violations that have already have an approval decision.
To display rule violations
In the menu bar, click Compliance > My Actions.
On the My Actions page, click Pending Rule Violations.
This opens the Pending Rule Violations page (see Pending rule violations (page description)) and displays all rule violations for which no approval decision has yet been made.
(Optional) To display rule violations that have already been approved or denied, click (Reset filter: decision status).
(Optional) To display details of the identity involved in a rule violation, take the following actions:
In the list, click the rule violation.
In the details pane, click the identity's name.
As exception approver, you can grant or deny approval to rule violations. If you grant approval to a rule violation, it is considered to be a exception approval.
To make an approval decision about a rule violation
In the menu bar, click Compliance > My Actions.
On the My Actions page, click Pending Rule Violations.
On the Pending Rule Violations, perform one of the following actions:
Click (Approve) next to the rule violation you want to approve.
Click (Deny) next to the rule violation you want to deny.
(Optional) To set an approval deadline, perform the following actions:
In the list, click the role violation for which you want to set an approval deadline.
In the details pane, enter the Valid until date.
Click Next.
(Optional) On the Exception Approvals page, perform the following actions:
For approved rule violations:
To provide a reason for all approved rule violations, enter the reason in the Reason for approvals field.
To use a predefined standard reason for all approved rule violations, select the reason in the Standard reason list.
For denied rule violations:
To provide a reason for all denied rule violations, enter the reason in the Reason for approvals field.
To use a predefined standard reason for all denied rule violations, select the reason in the Standard reason list.
To provide an individual reason for an approval decision, click Enter a reason and enter your reason.
TIP: By giving reasons, your approvals are more transparent and support the audit trail.
NOTE: For more detailed information about standard reasons, see the One Identity Manager Compliance Rules Administration Guide.
Click Save.
(Optional) If the approval requires multi-factor authentication, you are prompted to enter a security code. It may take a few minutes before the prompt appears. Perform one of the following actions:
Click Login with the Starling 2FA app and follow the app instructions on your mobile phone.
Click Send SMS or Phone call, enter the security code, and click Next.
You can resolve compliance rule violations that you manage. Rule violations are caused by permissions, so you have the option to remove permissions when you want to resolve one.
Permission assignments play and important role when editing rule violations. For example, permissions assigned through a dynamic role cannot be removed.
The following consequences may result from removing permissions:
Assignment Method |
Removing the Entitlement |
---|---|
Direct assignment |
Direct assignment is deleted when the entitlement is removed. |
Inherited assignment |
In the case of inherited permissions, there is an option provided to withdraw role membership from the identity. |
Dynamic assignment |
Permissions assigned through a dynamic role cannot be removed. |
Assignment by request |
If permissions were assigned through a request, the request ends if the permissions are removed. |
Primary assignment |
If permissions were assigned through a primary membership, the identity of the primary membership can be optionally revoked if the permissions are removed. |
To resolve a rule violation
In the menu bar, click Compliance > My Actions.
On the My Actions page, click Pending Rule Violations.
On the Pending rule violations page, click the rule violation you would like to resolve.
In the details pane, click Resolve.
This opens the Resolve a rule violation dialog and with more details about the rule violation and the permissions that lead to the rule violation.
Select the check box next to the permission that you want to be revoked.
Click Next.
In the Verify step, check the changes to be made.
TIP: The Action column show the consequences of revoking.
Click Next.
In the Loss of entitlements step, check which permissions are to be revoked to avoid losing permissions accidentally.
Click Next.
All permissions that were displayed for resolving the rule violation are withdrawn from the identity.
© 2024 One Identity LLC. ALL RIGHTS RESERVED. 使用条款 隐私 Cookie Preference Center