Certification Question

[SowmithriV]

We have an usecase to launch Certifications for base accounts on the target system reviewed by the Application Owners. Which of the Campaigns should be use? 

Also we want to make sure we have the list of accounts in the certifications that are active in the target system but have inactive user status. i.e., a campaign where we have both user and account query. Reviewer has to be an individual or a user group. 

Please share your ideas/suggestions. 

[pmahalle]

Hi @SowmithriV ,

Use Application owner Campaign. Also make sure to set endpoint certifier at the endpoint level to whom you want to set as a certifier.

[dgandhi]

You can use Application Owner Campaign.

At the endpoint level, assign certifier who will be certifying the accounts. Certifier can be users only and not user group. You can have more than 1 certifier(Primary and Secondary Certifier) assigned to an application. 

Application owner certification can include orphan accounts also.

[rushikeshvartak]

Application Owner certification

Documentation : https://docs.saviyntcloud.com/bundle/SSM-User-v55x/page/Content/06-mang-cert/cert-raso-app-ownr-camp... 

https://docs.saviyntcloud.com/bundle/EIC-User-v23x/page/Content/06-mang-cert/cert-pers-bsd-cert.htm 

Primary Certifier

For identity objects such as entitlements, roles, service accounts, and endpoints, you can add a primary and a secondary certifier as owners. A primary certifier can take actions on the certification and lock the campaign containing the certification. The primary certifier can also delegate owned line-items to another user, in which case that user becomes the delegated reviewer for that line-item. However, the primary certifier still retains responsibility for that line-item.

Entitlement Owner Role Owner Service Account Application Owner

[SowmithriV]

Thank you for the response @pmahalle @dgandhi @rushikeshvartak 
The challenge that I'm facing with the Application Owner Campaign is that, in the Advanced Query, there is not users table.

I want to include the base accounts that are active where as their Saviynt Profile is InActive. Is there a way to accommodate the "users" table in the Application Owner Campaign?