Password Policy Rule - Scope: User

[maurabagley]

1. When was the SaviyntDefaultRule password policy added?  I have a 23.5 env that has it and one that doesn’t.
2. Is this policy applied to every user in Saviynt, assuming you change the user’s password via Saviynt or does it have to be applied to the user first?  For instance, can some users not have a password policy and some have one?
3. If we want to enforce a stricter password policy, can we create a new one?  If so, how do we use that one instead of SaviyntDefaultRule?  (I know we can edit the existing one.)
4. How can we ensure that a user’s password has been changed after a new password policy is put in place?  I see that the user table has lastpasswordupdatedate but the policyrule table doesn’t have any update date.
5. If we want a stricter password policy applied to the admin, systemadmin, and SaviyntSupportAgent accounts, do we have to coordinate that with Saviynt?  I assume so for the SaviyntSupportAgent accounts but I’m not sure what the implications are of changing the admin and systemadmin accounts.

[pruthvi_t]

Hi @maurabagley ,

Greetings.

• Saviynt's default password policy comes with the build with predefined settings. you can always edit it based on your requirements.
• you can have only one USER scope password policy which would be applied to all the users.

Please take a look at the below screenshot and the documentation portal link, which describes the user scope password policy, application scope password policy and it has all the information on how they work. There are also sublinks in the left panel under this which gives you an insight into creating, updating and viewing the password policies and how they're assigned as well. 

documentation link : https://docs.saviyntcloud.com/bundle/EIC-Admin-v23x/page/Content/Chapter02-Identity-Repository/Manag...

Thanks,

[rushikeshvartak]

1. When was the SaviyntDefaultRule password policy added?  I have a 23.5 env that has it and one that doesn’t.
   1. By default SaviyntDefaultRule password policy gets created, if its missing you can create manually.
2. Is this policy applied to every user in Saviynt, assuming you change the user’s password via Saviynt or does it have to be applied to the user first?  For instance, can some users not have a password policy and some have one?
   1. Scope USER is always ONLY  one policy per instance
3. If we want to enforce a stricter password policy, can we create a new one?  If so, how do we use that one instead of SaviyntDefaultRule?  (I know we can edit the existing one.)
   1. You can update existing SaviyntDefaultRule
4. How can we ensure that a user’s password has been changed after a new password policy is put in place?  I see that the user table has lastpasswordupdatedate but the policyrule table doesn’t have any update date.
   1. You can expire all user's password by updating user's table passwordexpired column
5. If we want a stricter password policy applied to the admin, systemadmin, and SaviyntSupportAgent accounts, do we have to coordinate that with Saviynt?  I assume so for the SaviyntSupportAgent accounts but I’m not sure what the implications are of changing the admin and systemadmin accounts.
   1.  In order to avoid implication, Keep saviynt support upto date about change using Support ticket