Once templates are created, clients can use any of the templates to create User Access Review Campaign’s.  A created Campaign will incorporate the requirements from the pre-built template along with a start and end date. Campaigns define the reviewers and users to be a part of the user access review.  When a campaign is launched and email notifications configured, reviewers are able to approval or revoke credentials and entitlements.

Campaigns should be reserved for only those users which need to be reviewed. If users need to be “excluded” from a campaign, that should be handled at the application level with the Bulk Exclude action. Subsequent syncs of the application will keep them excluded. Client can export that list for auditors in order to see who has been excluded from any application campaigns. The Excluded Users action within a campaign is an additional check to make sure no users were missed out.

SecurEnds also provides End of Campaign notifications of all elections completed via email or submitted to various integrated ticketing systems. Click here to know more on Ticketing System Configuration.

The post About Campaigns appeared first on SecurEnds.

• Select Update to modify any details of the campaign like Name, Description, SOR Status (Active or Inactive), Change Applications, inclusion of entitlements.
  • Note: If an associated campaign is already launched, only a Name and Description update is allowed
• Select Details to get a summary of requirements for the template.
• Select Delete to remove the template.  You will be prompted to confirm.
  • Note: If the template is associated with a campaign, then  it cannot be deleted.  You will receive a message indicated the campaign name.  The campaign must be deleted before the template can be deleted.

Adding a New Campaign Template

• Navigate to Campaign Templates in the left-hand menu and select the Add button.

• A new menu will appear where you can enter the requirements for the template.

• Enter Template Name.
• Choose a Description to identify the Campaign.
• Select either Active or Inactive or both to designate status of users to be pulled into the review

User Status use case: If the System of Record has status information, campaigns can selectively choose active or inactive users to be pulled into a review. Selecting Inactive users is an easy way to answer the question “who is inactive in my HRIS/SOR, yet still has access to our applications?”

• Under Applications select which applications will be brought into scope for the review. Selected applications will populate below. Confirm and Save.

You’re now ready to customize your campaign using your newly created template! See instructions for campaign customization here.

The post Campaign Templates appeared first on SecurEnds.

Example: A CEO of the company where there is no one above the CEO to perform a review can use this option to conduct a review for themselves.

• Simply enter the email and select Add User.
• Note: any restrictions (users that can review themselves) will need to be present in the Source of Record (SOR) or need to be setup by the clients SecurEnds Admin before you create a campaign.

The post Campaign Restrictions appeared first on SecurEnds.

• Navigate to Campaigns in the left-hand menu and select the Add button.

• After selecting Add, the below screen will populate with your templates. Select the desired template to begin. You can use the search button to find a template if there are many templates in the view.
• Note: After selecting a template, a warning message may appear on the bottom of the UI. For testing purposes, this does not hinder moving forward, but if this message is encountered while creating a Production campaign, the cause of the warning will need to be investigated.

Customizing Your Campaign

• Campaign Name
  • This is the unique name to identify the campaign.
• Start Date
  • This will be the target date to begin the campaign.
    • NOTE: Campaigns are not automatically kicked off on the start date. An Admin will need to enter the system and manually launch the campaign.
• End Date
  • This is the target end date for the campaign.
    • NOTE: The campaign does not close on this date. It will not close until an Admin enters the system and closes the campaign.
• Delta Campaign
  • For the delta campaign type, once you refresh the application data with a sync/import, you create a delta campaign using the same template used in the previous campaign. Only new credentials found in the application data or if an existing credential has a new entitlement will show in the delta campaign results. There is no dependency on the SOR data.
  • Yes – Created campaign is based on changes since the previous campaign.
    • NOTE: Cannot utilize a delta campaign as a first campaign
  • No – Will run a full-scope campaign (scope is defined in template section).

Campaign Reviewer

• This section provides a combination of individuals that can be selected to perform the review of the campaign. A description for each role can be found below:

• Select who want to perform Access Review from the Campaign Reviewer options.
  • Manager is the person’s direct manager assigned in system of record.  If the user does not have a Manager defined in the People view then the review will go to the Default Reviewer.
  • Application custodian is the person who reviews all users of an application. This person can be assigned by clicking the gear icon (actions button next to application), select More and then select Custodian.  Important – Each application can have its own Custodian and will need to be setup for each application.
  • Entitlement custodian is the person who reviews all users associated to an entitlement. This person can be set up by clicking the gear icon (actions button next to application) and selecting Entitlement. Then once again, select the gear icon and select Custodian. Important – Each Entitlement will need to be setup with a Custodian. If this Campaign Reviewer type is selected and an Entitlement does not have a Custodian and the review will default to the Default Reviewer.
  • Alternate Reviewer can be any other user whom you want to perform Access Reviews. Must be present within the People view.
• Select Manager – if you want Access Reviews performed by the person’s direct manager. The Manager review will review application credentials and entitlements.
• Select Manager & Application Custodian – if you want both the Manager AND the Application Custodian to perform Access Reviews. This option will trigger two independent reviews. If the application does not have an Application Custodian defined, the review will default to the Default Reviewer.
  • The Manager review will review application credentials and entitlements.
  • The Application Custodian will only review application credentials, not entitlements.
• Select Manager & Application Custodian & Entitlement Custodian – if you want Access Reviews to be performed by the users Manager AND the Application Custodian AND the Entitlement Custodian. This option will trigger 3 independent reviews. If the application does not have an Application Custodian defined, the review will default to the Default Reviewer. If the entitlements within the application does not have an Entitlement Custodian defined, the review will default to the Default Reviewer.
  • The Manager review will review application credentials and entitlements.
  • The Application Custodian will only review application credentials, not entitlements.
  • The Entitlement Custodian will only review application entitlements and not credentials.
• Select Entitlement Custodian, Application Custodian – elections will be created for review by entitlement custodian for each entitlement where entitlement custodian is assigned. If entitlement is not assigned to a custodian, or there are self-reviews, these entitlement custodian elections will be reviewed by application custodian. If Application Custodian is not assigned, entitlements that were not reviewed by Entitlement Custodian will be skipped.  If there are any self-reviews for application custodian, they will be skipped.
  • The Entitlement Custodian will only review application entitlements and not credentials.
  • The Application Custodian will only review application credentials, not entitlements.
• Select Application Custodian, Manager – If the Application Custodian is assigned, elections will be created for review by Application Custodian.  If there are self-reviews, they will be moved to the Manager. If Application Custodian is not assigned, no application custodian reviews will be created.
  • This is a credential only review. No entitlements.
• Select Application ManagerReview – The managers are defined within the application data which you imported. This option is only available with CSV imports. This manager option will override any manager designations coming from the System of Record. If Application Manager is not assigned, the review will go to the Default Reviewer.
  • This will review application credentials and entitlements.
• Select Alternate Reviewer – if you want another user to perform all the reviews for the campaign.
  • Enter email of the person in prompted text box.
  • The Alternate Reviewer will review application credentials and entitlements.

Campaign Reminders

• Emails can be sent to the assigned reviewers and the manager of the reviewer to remind them that they still have elections within a campaign which need action. The email to the reviewer’s manager is an escalation email, the reviewer’s manager does not have any reviews to complete.
• Below are the options for email reminders that can be sent.

• Send reminder email to reviewer
  • This will send an email to all reviewers that have an open campaign which are not 100% completed.
    • NOTE: When a reviewer has completed 100% of their campaign, they will no longer receive the reminder emails.
• Select Email Template for Campaign Reminder
  • You have a choice to utilize the default Campaign Reminder email template or one that you may have created. If you have created additional reminder templates, they will all appear in the dropdown list.
• Send reminder email to reviewer’s manager
  • This will notify the manager of any reviewer that has not completed their portion of a campaign they are involved in.
• Select Email Template for Campaign Reviews Escalations
  • You have a choice to utilize the default Campaign Escalation email template or one that you may have created. If you have created additional escalation templates, they will all appear in the dropdown list.
• NOTE:
  • “Select number of days” refers to the number of days from the end date of the campaign. This end date was provided when the campaign was created.
  • “Every Consecutive Day” when checked, will send a reminder email every day leading up to the end of the campaign (assuming the selected party has not completed their task).
  • Consider the following example:

• For example – A Campaign end date of 12/11/2020, a campaign reviewer with an open campaign and users still to perform reviews against, will receive a reminder email on 12/9/2020 and every day until 12/11/2020 or until they complete the review.

Campaign Instructions

• There are the default campaign instructions which are displayed to the reviewers at the top of a campaign.
• These instructions will be shown for all campaigns unless you decide to use a ‘Custom’ instruction. The Default Campaign instructions can be edited (see below).
• From the dropdown, select to use the either the “Default” instructions, or “Custom” created instructions.

• Default
  • When a reviewer accesses an open campaign, they will be displayed the instruction in a green box at the top of the page.

• To Edit the Default Instructions, you can access those from the Administration->Configuration->Reviewer Notes

• Custom
  • These instructions can be edited to include any steps desired.
  • Note – once you ‘Save’ the campaign, these instructions cannot be updated.

Launch Campaign

• Once you ‘Save’ a newly created Campaign, you will be presented with a list of Campaigns which are in ‘Ready’ status. You can Launch a campaign from the Launch button if needed. SecurEnds recommends that you go to Campaign->Gear icon Action->View first before launching. This allows the creator to visually inspect a few reviewers first to ensure the campaign has the correct scope.

• You can also Launch a Campaign from the Action Gear icon

• Click on Launch option beside the campaign name, a pop up will appear to walk you thru the email options for the campaign. These emails are independent from the Campaign Reminder emails you setup when you created the campaign.
  • No – The Launch Campaign email will not be sent to all the reviewers
  • Yes – All reviewers and delegates will be sent a Launch Campaign email

• When selecting Yes, you will be provided with additional email options just to be sure.
  • Option 1, will send the Launch Campaign email to all reviewers.
  • Option 2, you can exclude certain reviewers from getting the Launch Campaign email. A list of all managers will appear below the template selection. You will need to select the check box manually for those whom you do not want to receive this email. Depending on the size of the campaign, you can have a lot of reviewers.
• You have the option to select the Launch Campaign email template to use for the campaign. If you created your own Launch Campaign email template, you can select it here.

• On successful launch of campaign, The status of the campaign now changes to Open.
• Once the campaign status changes to Open, reviewers can perform User Access Reviews.

• Once the campaign is Open, a SecurEnds Admin has several options. From Campaigns->Action Gear icon .
  • Select View to see how reviewers are progressing with the campaign. You can View a Reviewers detail by selecting View.
    • Select Review to see the elections done for that user.
    • Select Update Manager to change who can do the review. This will not change the manager for the System of Record.
      • The SecurEnds admin’s will get notified of a manager change. But the new manager who becomes the reviewer does not get notified unless there are campaign reminders configured to be sent out or if the Admin uses the “Remind” option to manually remind folks of pending elections (view the Remind feature below).
    • Select an Action from the drop down to provide a Termination Date for the user.
      • This will remove the elections from a Reviewer’s campaign scope.

• Other options include:
  • Select Excluded Users to see who was excluded from the campaign. Most users who “fail” to fall under a Review Type will default to the Default Reviewer. In the event that this requirement fails, excluded users will show with this action. Do not confuse this with the Bulk Exclude action at the application level.
    • Note: Users in a campaign who fail to default to the Default Reviewer as a last resort, most likely are reviewing themselves. Setting up a Campaign Restriction can allow this user to review themselves and be included in the campaign. But this must be done before a campaign is created.
  • Select Details to see all the Campaign information
  • Select Edit to modify the Campaign Name and/or the Campaign End Date. The Start Date is not editable since the campaign has been launched.
  • Select Close to end the campaign. The SecurEnds Admin can do this at anytime. The campaign is not considered complete unless the Admin manually closes the campaign. Once in a Closed status, you have the ability to Re-Launch a campaign. All Launch Campaign email options will again be presented and will only apply to those reviewers who are not 100% complete.
  • Select Remind to send all reminder emails to all reviews who are not yet 100% complete with their reviews. You will have an option to Copy the reviewer’s manager.
  • Select Delete to remove the campaign. You will lose all data for the campaign so select this option wisely.

• Delegations
  • There are 2 types of delegations that can be made: People Delegation and Credential Delegation. The Credential Delegation need to be in place before you create a campaign. The People Delegation needs to be in place before you launch a campaign.
  • People Delegation
    • When it is known that the original reviewer will not be available for a User Access Review, the SecurEnds Admin can delegate the reviews to another individual. This will not remove the original reviewer from the User Access Review or receiving campaign emails, delegation will simply allow another user to view and perform the User Access Reviews on behalf of the original reviewer. If enabled, both parties will receive an email that there has been a delegation for an upcoming review.
      • Assigning a delegation needs to be in place before you launch a campaign.
      • If a delegation needs to be made in the middle of the campaign, the Admin will need to close the campaign, put the delegation in place and then re-launch the campaign.
      • You can use the Delete action to remove the delegate at any time.

The post Creating Campaigns appeared first on SecurEnds.

Steps to assign a campaign owner:

Step 1: Once the campaign is being created, navigate to the Assign Campaign owner option.

• Click on “Yes”, to select the user(s) you would like to assign the campaign ownership to.
• (Note: You can assign 5 additional users as the campaign owner)

• Click on “Save”

Note: Once the campaign is launched, the assigned campaign owner will receive an email stating they are given the ownership of the campaign.

The post Assign Campaign Owner appeared first on SecurEnds.

People Delegation:

When it is known that the original reviewer will not be available for a User Access Review, the SecurEnds Admin can delegate the reviews to another individual. This will not remove the original reviewer from the User Access Review or receiving campaign emails, delegation will simply allow another user to view and perform the User Access Reviews on behalf of the original reviewer. If enabled, both parties will receive an email that there has been a delegation for an upcoming review. If you use the Campaign Remind action, both the original manager and the delegate will receive the Campaign Reminder email.

Credential Delegation:

Credential Delegation is an option that lets you define a different reviewer for the direct reports of other managers (i.e senior executives, CEO’s) who do not need to be a part of a campaign. A Credential Delegation allows the admin to delegate a specific user’s reviews (maybe a CEO and other executive level employees) to another manager/reviewer. This new selected manager/reviewer will be conducting a review and act as a reviewer to that direct report throughout the campaign. The original manager will be completely removed from the campaign and any campaign emails. This delegation type is assigned by Application within the SecurEnds application and must be in place before the campaign is created.

Unlike a People Delegation, with a Credential Delegation you are re-assigning the direct reports to a different reviewer. Once the SecurEnds Admin assigns a Credential Delegation, all campaign notifications will be sent to the new delegate and not the original reviewer/manager.

Steps For People Delegation:

• To assign a new People Delegation, click on Add a new window will pop up on the right hand side. Type the previous reviewer’s email address under Reviewer Email and the new delegate’s email address that is present in the Source of Record (SOR) in the Delegate Email. Click Save.
• Once added, the new delegate will receive a delegate email notification with the previous reviewer cc’d on it.
• You can use the Delete action to remove the delegate at any time.

Steps For Credential Delegation:

• To assign a new Credential Delegation, select Credential Delegation from the drop down.
  • Select the application which the managers direct reports are included. You can select All Applications if you like. Keep in mind that the direct reports of the manager would need to be in all applications for the person to be searchable.
  • Once you have the application selected, type the name of the direct report into the Search Email box, let the application find that person and select them.
  • Select the credential in the box area below.
  • Type the name of the “new” Reviewer in the Reviewer text box, let the application find that person and select them.
  • Hit Save. The page will refresh.
  • You will need to re-select the application from the drop down or select All Applications to see your delegations.
• You can use the action Gear icon to Delete the delegate at any time.

The post Delegation appeared first on SecurEnds.

The SecurEnds Admin will have two actions that can be utilized for each campaign:

• Select Report to view two reports options which are available for a Campaign. You can click into the Pending, Approved or Revoked parts of the pie chart.

Once you click Report, a new page will appear with a pie chart that depicts the status of the selected Campaign under Campaign Report and the Campaign Effectiveness Report. The pie chart is interactive and will allow you to see each information by clicking the desired option.

Campaign Report:

As we select and click the various options on the pie chart, the information will start to populate on the screen below.

The tool also offers to export this report into a CSV file.

• Click Export, a CSV file would download which would have all the data from the campaign in it.

Campaign Effectiveness Report:

With this selection a user is able to get granular with the campaign status by selecting options such as Application and Time period. It also displays the start and end dates of the campaign with the ability to export the data.

The post Campaign Reports appeared first on SecurEnds.