Skip to main content

HelloID

Exclusions

In many organizations, there is a need to prevent automated processes from touching certain employees' accounts. For example, the CEO, principal, or anyone else whose account data must adhere to different standards. Exclusion can also be used for testing Provisioning configurations.

When a person is excluded, they are not processed during Enforcement.

Persons can be excluded either manually, or automatically through the source mapping. The latter is useful for testing your Provisioning setup. See Manually exclude a person or Exclude persons via source mapping.

You can Re-include a person at any time.

Exclusions can be viewed in Business > Exclusions. Manually excluded persons are labeled with the Manual indicator. Automatically excluded persons are labeled with the Source indicator.

Business_Exclusions_SourceAndManual.png

Excluded persons are also labeled on the Persons overview:

Persons_Information_Excluded.png

Exclusions can also be triggered by the Person aggregation feature. In this case, they are labeled with the Skip Processing indicator, but are handled the same way.

Unlike Target system thresholds, exclusions selectively exclude certain persons from enforcement. Target thresholds partially or fully halt enforcement if it is significantly different than the previous enforcement.

Excluding persons with granted entitlements

If you exclude a person to whom HelloID has already granted Entitlements, those entitlements remain granted while the person is excluded, even if the person goes out of scope of the qualifying business rule or if the rule is deleted. If you include the person again later, entitlements will be updated accordingly during the next enforcement. In other words, exclusion is different than an Unmanage an entitlement action, which forgets entitlements permanently. Exclusion remembers entitlements and "catches up" on any entitlement actions when a person is included again.

When an excluded person is removed

If an excluded person's raw personnel data is removed from its associated source system, the excluded person will be removed during the next enforcement, and all of its granted entitlements will be revoked (see Revoke). This behavior is the same for normal (non-excluded) person.