Recertification
Warning
This feature requires a Governance module license.
Recertification ensures that users in your organization have appropriate access to self-service products based on the latest policies.
Over time, access permissions may become outdated or no longer align with current rules. For example, a product may not have been returned after a user was disabled, a user may no longer have the required group memberships, or a product may have been assigned multiple times to the same user even though the current self-service product configuration only allows one assignment per user.
Recertification campaigns automate the process of reviewing and validating user access to self-service products.
There are two types of recertification campaigns: system campaigns, of which the name and scope cannot be modified, and custom campaigns, which each have their own scope of assigned products.
When it runs, a recertification campaign generates Insights: an overview of approved product requests that qualify for recertification within the scope of the campaign. Insights can be viewed via the Recertification insights end-user page.
Tip
You can preview recertification insights when editing or viewing a custom campaign.
Insights are always generated. Depending on its settings, the campaign may also trigger recertification requests for these assigned products. Recertification requests follow the configured approval workflow to confirm or revoke access. Any recertification requests that you can approve or deny are displayed on the Recertification requests end-user page.
Successive runs of a recertification campaign are called iterations. Each iteration recalculates which approved product requests fall in the scope of the campaign, and optionally triggers recertification requests.
Approvers may be notified by email that a recertification request is waiting for their approval.
If the setting 'Specify approvers' is disabled for the current approval workflow, members of the fallback approval workflow group will be prompted to review the recertification request.
The fallback approval workflow group and notification settings are selected in the recertification settings, which apply to all campaigns.
To get started, edit the recertification settings. Then, start a new campaign iteration of a system campaign, or create a custom campaign.
Note
The HelloID Recertification Management - Start new campaign iteration right is required to start a new campaign iteration.
The HelloID Recertification Management - Manage campaigns right is required to create a new custom recertification campaign.
To view the recertification insights end-user page. you must have the Recertification - Insights right and be a member of the configured recertifcation campaign access group.
To view the recertification requests end-user page, you must have the Recertification - Recertify right and be a member of the configured recertifcation campaign access group.