A user review campaign asks reviewers to review and certify the access of a set of users within a period. Create one to start a recurring access review for your whole user base, or a smaller campaign for specific users or user groups.
Requirements
- By default, the PAM Administrator or System Administrator role.
- At least one active global approver for the User Management module. Without one, Segura™ refuses to create the campaign with the message A global approver must be defined. Configure one to continue. To add one, see Register an approver user.
- Reviewers assigned to your users. Check the Users by reviewer report in Settings > Access control > Users review and certification > Users by reviewer. Users with the Assignment type
Nonehave no reviewer, so the global approver reviews them. - Reviewers with the Access review and certification role, which they need to open the review screen.
- No other user review campaign with the status
ScheduledorEnabled.
Steps
-
On Segura™, in the navigation bar, hover over the Products menu and select Settings.
-
In the side menu, select Access control > Users review and certification > Campaign.
-
Click Add.
-
In the first Type field, which sets the campaign type, keep
Users. -
Fill in Name and, optionally, Description.
-
In Start date, select when the campaign starts.
-
In Duration, set how long the campaign lasts, and in the Type field next to it, select
Days,Months, orYears. -
In the Scope section, select the Campaign scope:
All active users: the campaign reviews every user active on the start date. This is the default.Specific users: click Add, search for and select the users, and click Add. To take users out of the list, select them and click Remove.
If you change the option, your earlier selection is kept but not used. Only the selection for the option selected when you save counts.
Specific user groups: click +Add and select the user groups. Each group shows its number of active members. Select at least one group with an active member.
-
Check the users without a reviewer. With
Specific users, when you save, the confirmation shows how many selected users have no reviewer. The global approver reviews those users. The warning does not prevent saving. -
Check the Global approvers section. It lists the global approvers for the User Management module, who review the users with no reviewer and, when the Enable approval workflow for users review and certification parameter is on, approve each completed review. To add a global approver, click Add. This changes the shared list of global approvers for the module, not a list for this campaign only.
-
Optionally, in the Advanced options section, turn on Enable escalation and set the deadline. Escalation passes a pending review to the reviewer's own reviewer, up to the global approver. The deadline cannot be longer than the campaign duration.
-
Optionally, turn on With recurrence and set the interval. The interval cannot be shorter than the campaign duration.
-
Click Save.
The campaign appears in the campaign report with the status Scheduled.
What happens when the campaign starts
While the campaign is Scheduled, you can change it with Edit in the Actions column, including its scope and global approvers. In the campaign details, the Global approvers section is read-only.
When the campaign starts, the scope becomes read-only and Segura™ fixes the list of users:
- Users created after the start, or inactive on the start date, are not reviewed in this campaign.
- Users who join a selected user group after the start are not reviewed in this campaign.
- A recurring campaign with the
Specific usersscope repeats the same list of users. - If the selected user groups have no active members, Segura™ sets the campaign to
Closed. The campaign details show the reason.
Only the reviewers of the users in the scope receive the campaign e-mails. Global approvers receive them when the scope includes users with no reviewer.
While the campaign runs, Segura™ refuses to remove the last global approver for the User Management module. If that approver's user is deactivated or deleted, the campaign is paused until you add a new global approver and resume it. For details, see Campaign.