Review details¶

The Reviews / Details page allows you to view more detailed review information. Some of the information within this area can be changed depending on the status of the review.

To open the Reviews / Details page:

1. Go to the Manage menu and select Reviews. The Reviews list is displayed.

2. Select the review you want to view. The Reviews / Details page is displayed.

Refer to the following sections for more information about each tab.

Overview tab¶

The Overview tab provides an executive summary of the review and includes information that may be helpful for auditing purposes such as the date the review was started, the number of applications included, total number of identities, total number of review items, and so on. This tab is not available when reviews are in a "Draft" status.

The information on this tab cannot be changed, but the report summary can be printed by selecting the Export button in the upper-right corner of the tab.

The Comments area at the bottom of the page allows you to add comments to the review.

Applications tab¶

The Applications tab on the Reviews / Details page provides a list of all applications and separation rules included in the review. When a review is in "Draft" status, you can add or remove applications and separation rules as needed. After a review is started, this tab is locked and is only available for viewing.

Settings tab¶

The Settings tab on the Reviews / Details page allows you to specify a name for the review and choose options that will determine the general process of the review such as the type of review, who will be required to approve items, and so on.

Requirements¶

Review type¶

Select one of the following types:

Pre-approval conditions¶

If you would like Permission Assist to help with the review, you can select one or more of the following options to determine whether an item is eligible for pre-approval.

When an item is pre-approved, it means Permission Assist has analyzed the item according to both the system criteria (built into Permission Assist) and the selected criteria (the options described below) and has determined the item meets that criteria.

Each option you select below will be an additional requirement that must be met for an item to be eligible for pre-approval. For example, if you select both the "Permissions have not changed..." and the "No permissions are overprivileged..." options, then the item cannot be pre-approved if either the user has any new permissions or if the user's permissions exceed the permissions allowed by their associated access models.

Review item filters¶

This area is used to filter the list of review items based on either identity or application user "type." For example, if you are required to review administrative accounts on a regular basis, the filters can be used to only show users that have an "Administrator" type.

To add a filter rule, complete these steps:

1. Make sure your application users and Identities have a defined type.

   • For Identities: the rules within the directory source often define the type, but the type can also be set within each individual identity
   • For application users: the type can be set within each application user

2. Select one of the following options:

   • all - when this option is selected, all review items are included in the review by default. This option is great for situations where you want to include most of the users within the application, but want to exclude just one or two types of users. For example, when you want to see all review items except vendor accounts
   • none - when this option is selected, no review items are included in the review unless you add rules to include them. This option is great for situations when you only want to review a very specific sub-set of users. For example, when you only want to review service accounts

3. For each filter rule you want to add, complete the following steps:

   a. Select the Add Rule link.

   b. Select the appropriate options for each field of the rule as described below:

   Field	Description
   The [matching identity]	Select one of the following options: matching identity - this field is set to "Identity" by default. When this option is selected the list of review items is filtered based on the identity type. application user - if you want to filter the list of review items based on a specific type of application users, select this field and pick application user from the list.
   is of type [Employee]	This field is set to "Employee" by default. Select the type of Identities or application users you want to see (or not see) within the review. Options include: Unknown, Employee, Service Account, Vendor, Shared, Mailbox, Client, Temporary, Administrator.

Comments¶

Select the situations in which a reviewer must enter a comment. One or more options may be selected.

Reviewers¶

For each review, you have the option of including a variety of reviewers including the Security Team, Application Managers, Supervisors, and more. The options in this area allow you to determine both which reviewers are required and the degree to which each role is required.

To add a required role:

1. Select the Insert review requirement for field and then select the role you want to require from the list.

2. Select the Add Rule link. A requirement is added.

3. For each required role, fill in each of the fields as needed to define the review requirements:

   Field	Description
   At least [one]	This option is not available when adding rules for Supervisors, Area Reviewers, or any of the Defined Managers. When adding a new requirement, this field is set to "one" by default which means that at least one person within this role is required. Some roles allow you to add two roles. To require two people within the role, select this field and then select two from the list.
   is/are [always]	This field allows you to determine whether the reviewer is always required or conditionally required. The Security Team must always be an optional reviewer (that rule cannot be removed). You can add an additional rule for the Security Team to make them required if needed. Always - By default, this field is set to "always", which means a person in this role must review items and take action to approve or flag them in order for the items to be completed. Conditionally - When this option is selected, a person in this role is required to review items, but only if certain conditions are met.
   Required	This field is set to "required" and is the only option available for Security Team members; however, some roles may be considered either required, optional, or required if present. Required - every item assigned to the role must be completed by someone in that role without any exceptions. Optional - reviewers can log in to Permission Assist and see the items for their role; they can also approve or flag items; however, the items they approve or flag will not be considered complete until the required reviewer(s) mark the items as approved or flagged. Required if present - people within the role are only required to respond if they have been assigned to an item. Items that do not have a person within the role will be escalated to the Security Team.
   when the application	This field appears when the "is Always" field is changed to "conditionally". By default, this field is set to "application" which means that the role is required to respond when an application has a certain priority level. If you would like the role to respond only when a user has access to privileges of a certain priority, select this field and then select privilege from the list.
   has a priority/risk rating of none	This field appears when the "is Always" field is changed to "conditionally". By default, this field is set to "none" which means the role is required to respond when the application or privilege has a priority/risk rating of "None" or higher. Select this field and then select a priority level from the list to change the threshold.

Timelines¶

Notifications¶

Before start¶

On start¶

During review¶

On completion¶

Pending responses tab¶

The Pending Responses tab on the Reviews / Details page displays a list of all reviewers that have outstanding review items. Selecting a name within the list opens a details panel on the right side of the page, which shows a list of the applications the reviewer is associated with and the pending responses for each application.

This tab also allows you to send email reminders to everyone in the Pending Responses list or to a specific reviewer within the list.

Send email reminders¶

The Pending Responses tab on the Reviews / Details page allows you to send email reminders to either one reviewer or to all reviewers with outstanding review items.

To send an email reminder to all reviewers with outstanding items, select the Send Reminders button.

When sending reminders to everyone, the system will send a separate email to each person in the list.

To send an email reminder to a specific reviewer, select the person you want to send a reminder to, and then select the Send Reminder button in the details area.

Print a review summary report¶

The review summary may be printed for auditing purposes and is available in either PDF or Excel formats.

From the reviews list, select the review for which you want to print a report. The Reviews Detail page appears with the Overview Tab displayed. Select the Export button in the upper-right corner of the Overview tab and then pick either Excel or PDF.

Reports tab (print review reports)¶

The Reports tab on the Reviews / Details page quickly provides all the reports you need for review management and auditing purposes. These reports can be printed either while the review is in an Open status or after the review is Completed.

To print a report, select the report you want to print, and then select the Export button. For reports that contain a large amount of data, the report will continue to build in the background, allowing you to continue your work. When the report becomes available for downloading, Permission Assist will alert you by displaying a notification indicator next to the Reports menu on the menu bar.

If the zipped file has not been downloaded within 15 minutes of being generated, an email notification is sent as a reminder. Only one email notification is sent, and it will only be sent if the file is not downloaded within 15 minutes.

For more detailed information about each of the available reports, refer to the Standard Reports section of the documentation.