Create Policy Review Campaigns

As an Administrator or Campaign Administrator of Oracle Access Governance, you can create one-time or periodic access review campaigns from the Console. In this article we will look at how you can create on-demand policy reviews, where you define the selection criteria based on the policies associated with users. You can also define the approval workflow to select the number of review levels, review duration, and reviewer details.

Note:

Customers with existing campaigns created prior to the July 2023 release (legacy campaigns), should be aware of the following points regarding compatibility:
  • All legacy campaigns that were in Draft or Scheduled state, will be amended to System Aborted state.
  • Users will not be able to clone legacy campaigns. You will only be able to clone new campaigns, created with the July 2023 release and future releases.

Login

  1. Sign in to the Oracle Access Governance Console with a user assigned either the Administrator or Campaign Administrator application role.
  2. You can select one of the following options to navigate to the Campaigns screen:
    1. On the Oracle Access Governance Console home page, select the Access Reviews tab, and click the Select button on the Define a new campaign tile. Click the Select button on one from the Review access to systems managed by Access Governance, or Review access to Oracle Cloud Infrastructure tiles.
    2. Click the Navigation menu icon, and select Access Reviews, and then Campaigns, then click the Create a campaign button. Click the Select button on one from the Review access to systems managed by Access Governance, or Review access to Oracle Cloud Infrastructure tiles.

    You will be navigated to the Create a new access review campaign workflow screen, from which you can define and configure your policy review campaign.

Selection Criteria

By default, all identity data ingested from the orchestrated system is available to the access review campaign. This may be a large amount of data, so selection criteria allows you to narrow the criteria available for the campaign:

Criteria for policy reviews can be filtered based on:
  • Which Policy

Note:

If you select the policy criteria, user criteria selection is no longer applicable and is disabled.
Additionally, you can also add the following filter in combination with those listed above:
  • Which tenancies

These criteria can be chosen and edited in any order before moving on to the next step. If you do not need to update each dimension, you can select any number from those above, and leave the remaining unchanged. If you do not need to narrow the criteria for your enterprise, then you can choose to move to the next step without adding any selection criteria.

Note:

All criteria can be searched by name
  1. Select the Which tenancies? tile to specify criteria based on a specific cloud provider. Actual values for this parameter will depend on the target system you select.
    1. If you want to restrict the values further, click on theMenu menu icon, and select Refine further. In the Cloud provider pop-up, you can further refine your criteria by specifying one or more compartments, and/or one or more domains from the cloud provider you have select in the main step.
  2. Select the Which Policy? tile to set criteria for policies.
  3. On selecting this tile, you can select criteria for the following parameters:
    • Policy name
    • Policies created since a given date
  4. Make your selections and when finished, click on Apply my selections or Cancel as appropriate. You are returned to the Create a new access review campaign step.

    Note:

    As you make selections of the various criteria, you can see the effect that your selections make and an estimate of the number of review items that your access review campaign will generate. This information is displayed in the section on the right-hand of the page.

    Note:

    If you need to make changes to your selections before moving on to workflows, select the Modify button on the relevant tile and amend as described in the steps above.
  5. When you are happy with your selection criteria, click I'm good, go to workflows button to proceed to the Assign workflow dimension to select the guided workflow.

Assign Workflow

The Assign Workflow step is where the approval workflow for your access review is selected.

  1. Select which approval workflow you want to assign to this access review campaign. A list of the available workflows shows all approval workflows defined in your system. For details on how to create and manage approval workflows see Create Approval Workflow and Manage Approval Workflow.
    Once you have selected your workflow the View approval workflow link is displayed. Click on this to see a diagram of the selected workflow.
  2. Select the scope of justification required for access review devisions from the following values:
    • Required for all review decisions
    • Required only for revoke decisions
    • Optional for all review decisions
  3. When you are happy with your workflow selection, select Save draft to save your campaign for work later on or select Next to proceed to the Add details page.

Add Details

With the Add Details step, you can define the frequency (one-time or periodic) at which to run an access review campaign, give a meaningful name to your campaign, add a supporting description, and assign values to additional attributes, such as who owns it and when the campaign should start or end.

To add details :
  1. Add values for the following parameters for your campaign:
    • How often do you want this to run?: Select One time to run a single occurrence of this campaign, or select a recurring pattern like Quarterly, Monthly, Half-Yearly, or Yearly to run this access review campaign periodically.
    • What do you want to call this campaign?: Add a name for your campaign.
    • How do you want to describe this campaign?: Add a description for your campaign.
    • Who owns this campaign?: Add the name of the campaign owner.
    • How would you like to schedule your campaign?: You can view this field only if you have selected to run your campaign one time. Select either Run now or Schedule Later. By default, the campaign is set to begin at the top of the next hour, the following day of campaign creation.
    • When do you want to Begin?: If you have set a recurring pattern, then select the start date of when you want to begin the campaign series. By default, the campaign is set to begin at the top of the next hour, the following day of campaign creation. If you want to change this, select the Select Date Time icon and add a new date/time.
    • When do you want to End?: If you have set a recurring pattern, then select the end date of when you want to end the campaign series.
  2. Once you have set your preferences, select Next to go to the Review and submit step.
  3. Optional: You may select one of the additional actions:
    • Save Draft: To save your changes and later come back and edit the workflow or details.
    • Cancel: To cancel the current process.
    • Back: To go back to the previous step.

Review and Submit

The Review and submit step displays the information you have added in the previous steps.

To review and submit your campaign :
  1. Select Save draft to save your campaign for work later on or select Create to create the campaign.