In this use case are described review access right services in Self-Service, and how end-users can review active access rights at any time, or when there are open review requests like for example need to review if one single access right is still valid for all the users (also known as re-certification).

1. Review my access rights: for reviewing your own active access rights.
2. Review access rights (managers): This service allows you to review access rights of your team members.
3. Review access rights (approvers): This service is designed for reviewing access rights and business roles for users in your organization for those access rights where you are defined as approver.

End-user

Manager

Approver

Self-Service

IGA solution

For reviewing access rights at any time end-users will need access to review service(s) in the Self-Service. 

For reviewing open access right review requests, IGA admin has created re-view request in the IGA solution, and user has received an email notification about review requests waiting for actions. 

Users access rights are reviewed, updated, unnecessary ones are removed. Results are stored for auditing purposes, and review in ended.

1. User logins to Self-Service and opens “Review my access rights” -service. 
   • User will receive email if user has open access right review requests
   • User can review all active access rights at any time
2. User selects either
   1. Ongoing access right review requests (re-certification)
   2. Review all my access rights (review access rights)
3. When user has selected “ongoing access right review request”
   • User selects one of the ongoing requests from the list
   • User can immediately see list of access rights under review which user has active at the moment
   • On the next page user can request more access rights
   • One the next page user can request access rights to be removed 
   • On the last page user gives result for the review and sends the review request forward
4. When user has selected “review all my access rights”
   • User selects one of the users work periods
   • User can immediately review active access rights
     • List of applications where user has accesses
     • List of access rights requested from Self-Service
     • List of business roles requested from Self-Service
     • List of automatically granted access rights
     • List of automatically granted business roles
     • List of owner responsibilities in the IGA solution
     • List of approver responsibilities in the IGA solution
     • List of team memberships in the IGA solution
   • On the next page user can request more access rights
   • One the next page user can request access rights to be removed 
   • On the last page user gives result for the review and sends the review request forward
5. IGA solution receives information from Self-Service and based on results, either adds, removes or stores auditing details that review was successful

1. Manager logins to Self-Service and opens "Review access rights (managers) -service
   • Manager will receive email if manager has open access right review requests
   • Manager can review subordinates all active access rights at any time
2. Manager selects either
   1. Ongoing access right review requests (re-certification)
   2. Review all application related access rights (review access rights)
3. When manger has selected “ongoing access right review request”
   • Manager selects one of the ongoing requests from the list
   • Manager can immediately see list of access rights under review
   • Manager can review subordinates who has the selected access right or business role active at the moment
   • On the next page manager can request more access rights to all subordinates
   • One the next page manager can request access rights to be removed from all subordinates
   • On the last page manager gives result for the review and sends the review request forward
4. When manager has selected “review application related access rights”
   • Manager can see list of all applications used by subordinates and manager selects one of the applications
   • Manager selects one of the related access rights or business roles
   • Manager can see list of subordinates who has the selected access right or business role active at the moment.
   • On the next page manager can request more access rights
   • One the next page manager can request access rights to be removed 
   • On the last page manager gives result for the review and sends the review request forward
5. IGA solution receives information from Self-Service and based on results, either adds, removes or stores auditing details that review was successful 

1. Approver logins into Self-Service and selects "review access rights (approvers) -service
   • Approver will receive email if user has open access right review requests
   • Approver can review all application related access rights at any time

1. Approver selects either
   1. Ongoing access right review requests (re-certification)
   2. Review all application related access rights (review access rights)
2. When approver has selected “ongoing access right review request”
   • Approver selects one of the ongoing requests from the list
   • Approver can immediately see list of access rights under review
   • Approver can review users who has the selected access right or business role active at the moment
   • On the last page approver gives result for the review and sends the review request forward
3. When approver has selected “review all application related access rights”
   • Approver selects from the list of the applications requiring my approval for access rights 
   • Approver selects one of the related access rights
   • Approver can see list of users who has the access right or business role active at the moment
   • On the last page approver gives result for the review and sends the review request forward
4. IGA solution receives information from Self-Service and based on results, either adds, removes or stores auditing details that review was successful 

In this use case are described how IGA admin can start, define, monitor and audit access right review requests. 

IGA admin

IGA solution

One-time or recurring review request has been created, reviewers are notified, results are visible and auditing details are saved. 

1. IGA admin opens list view for IGA Review Access Rights and selects new from the list view. 
2. IGA admin fulfills following information
   • Review information
     • Name & description
3. IGA admin chooses type
   • Review
4. If review type, IGA admin fulfills following information
   • Choose content
     • Application 
     • Single entitlement 
     • Multiple entitlements (more than 1)
     • Single business role 
     • Multiple business roles (more than 1)
   • If application is selected IGA admin selects the application from the list which entitlements are going to be reviewed 
     • All related entitlements under review are automatically listed, but IGA admin can remove unnecessary ones
   • If single entitlement or single business role is selected IGA admin selects the entitlement or business role from the list which is going to be reviewed
     • IGA admin selects if approval type is
       • Approval request, which will generate approval request to Self-Service
       • Review service, which will generate review request and expects user to use one of the review services in Self-Service 
   • If multiple entitlements or business roles is selected, IGA admin selects one or more entitlements or business roles which are going to be reviewed
     • In these cases approval type is always: Review service, which will generate review request and expects user to use one of the review services in Self-Service 
5. IGA admin selects target for the review
   • Users who has selected entitlements or business role active at the moment
   • Users with certain title(s)
     • One or more can be selected
   • Users with certain cost center
     • One or more can be selected
   • Users in certain organizational unit
     • One or more can be selected
6. IGA admin defines scheduling for the review
   • Recurrence, one-time
   • Start date for the review (when review requests are send to users)
   • End date for the review (last day for users to review their access rights)
7. IGA admin defines reviewers and communication 
   • If users whose access rights are under review are required to give own opinion if the access right is still needed, IGA admin can select: Include users in the review
     • Entitlements or business roles are not automatically added or removed from the user based on users decision, but user can suggest changes to own access rights, but removal / granting is made based on manager and/or approver decisions.
   • Reviewers
     • Managers - review request is required only from managers whose subordinate has the access rights active at the moment
     • Approvers - review request is required only from approvers defined in the selected entitlement(s) or business role(s)
     • Managers + Approvers - review request is required from both
     • Selected persons - IGA admin can select individual person(s) to review the access rights
   • Notification to reviewers
     • Automatic - pre-defined email is send to users whose actions are needed for the review
     • Manual - IGA admin can write email which is send to users whose actions are needed for the review
       • If customer is using M42 Intelligence - Comms assistance can assist IGA admin to write the email and translate it to different languages
8. IGA admin saves the data card and review is started and review requests are send to users according to defined scheduling.
9. IGA admin can immediately see and report from the saved review request
   • Number of generated review requests
   • Number of users under review
   • List of users under review
   • Number of reviewers IGA
   • List of reviewers
10. When end date occurs  the review process ends, or IGA admin takes one of the following actions, 
    • Cancel ongoing and scheduled review requests 
    • Start re-review 
    • Creates and schedules next review 
    • Audit & report review results

1. IGA admin opens the ongoing review request, which needs to be cancelled
2. IGA admin edits scheduling for the review request
3. IGA admin selects “cancel review” and saves the data card
4. IGA solution closes all open review requests and sets status to cancelled and result is set to closed, has open requests for the review request
   • IGA admin can review from results how many requests was cancelled
5. Process ends and auditing details are saved

1. End date for the review request has occurred, but there are still open review requests
2. IGA admin opens the ongoing review request, which has open requests, even the end date has occurred and re-review is required to start. 
   • From review results IGA admin can see how many and which of the requests were not review in time
3. IGA admin edits review results by setting result re-review required and saves the data card
4. IGA solution creates new review requests and informs only the users who did not finalize the original review in time.
5. IGA admin monitors re-review and ensures that all requests are reviewed
6. IGA admin can start re-review request as many times as needed

1. IGA admin has several pre-defined reports, views and dashboards for monitoring and reporting access right review results
   • IGA admin can create new, update or remove existing reports/views/dashboards
   • All review requests
   • Ongoing and scheduled requests
   • Last reviewed entitlements, business roles and users
   • Never reviewed entitlements, business roles and users
   • Most reviewed entitlements and applications
   • % of users and entitlements whose/which accesses are never reviewed
2. IGA admin can monitor results of the review request
   • Total number of requests
   • Number of unhandled requests
   • Number of approved requests
   • Number of rejected requests
   • Number of cancelled requests
3. IGA admin can see timestamps for the review from statistics
   • Review time 
   • Review done
   • Review canceled
4. IGA admin can review workflow information, and in case provisioning fails during access right requests or removal requests, IGA admin task is generated from the IGA service request. Please follow up IGA administration instructions.