How to Exclude Birthright Access (Account and Entitlements) from User Manager Campaign?

[DaanishJawed]

Use Case

By default, a User Manager campaign will allow the manager to review accounts and accesses that are granted to the user through Request Access and also assigned to them through Birthright Rules.

In case you have a requirement to allow manager to certify access and accounts granted only through Request Access then the following solution needs to implemented.

Applicable Version(s)

All Applicable versions

Solution

1. Navigate to Certification > Click On Create Campaign > Select Campaign type as 'User Manager'> Scroll down to Advance Campaign Configuration > In Account Entitlements Query enter the below query
2. Add the following case sensitive query:

Query - ae1.assignedFromRule is null

Note: The format is camel-case and needs to be entered in the exact format as above.

Reference Document for User Manager Campaign -

https://docs.saviyntcloud.com/bundle/EIC-Admin-v2021x/page/Content/Chapter06-EIC-Configurations/Conf...

[shibinvpkvr]

@DaanishJawed : If the Entitlement was assigned via a Role and the Role was assigned through a birthright rule, can we still use the Query - ae1.assignedFromRule is null to identify/exclude birthright access from certification? 

[ASA]

@shibinvpkvr Tested it and it works als in this case.

What it doesn't do is excluding the Enterprise Role itself from certification, if it was assigned via birthrights.