Creating a campaign
Use this task to create the campaigns.
About this task
Procedure
- Log in as an administrator on Verify.
- The Verify user launchpad opens. Navigate to the Profile menu icon and click Switch to admin.
-
Select Applications > Access certification.
The page shows the number of campaigns that are running, scheduled, paused, and closed.The summary tables display the following categories for each running or pending campaign.
- Name
- Progress
- Type
- Applications
- End date
- Time left
The Other campaigns section in the page displays the Scheduled, Draft, Paused, and Closed campaigns' details in a table format.
- Click Create Campaign.
- Specify the following information and click Next.
- Name
- The name for the campaign.
- Description
- Optionally, provide the reason or purpose of the campaign.
- Campaign type
- Specify whether the campaign is for user entitlement, group entitlement, or account.
- Priority
- Specify the importance of the campaign, either high, medium, or low.
- On the Applications scope step, click
the Choose applications dropdown to select one or more of the applications
for the campaign. Note: In User entitlement campaign, the scope can be defined either on applications or entitlements. If you intend to scope the campaign only upon granular set of entitlements, you need not select an application.
- Based on the selected Campaign type, the
following steps are displayed:
- Entitlement Scope
-
The step is only displayed in User entitlement campaign.
You can define the scope on granular set of entitlements. If one or more applications are selected in Application scope, the scoping is defined on the entitlements of the selected application (s).
Select 'Include only' or 'Except for' to further scope to a subset of entitlements.
Note: Entitlement scope is a requestable feature, VDEV- 41518. To request this feature, contact your IBM Sales representative or IBM contact and indicate your interest in enabling this capability. You can also create a support ticket if you have the permission. Note that IBM Security Verify trial subscriptions cannot create support tickets. - User Scope
-
The step is displayed for both User entitlement and Account campaign.
Typically, all users that are entitled to the applications are included in the campaign. To limit the scope, you can specify the users that you want to include in the campaign under Include only. All other users are automatically excluded. Alternatively, you can list the users to be excluded under Except for.Note: In User entitlement and Account campaign type, you can either specify the inclusion or the exclusion list in the User scope.In Include only selection, you can use the user scoping enhancements: Fixed set or Condition set tabs to filter the users. The Fixed set allows you to search and select multiple users. The Condition set allows you to add multiple filter conditions to filter the users. Switching between the Fixed set and Condition set tabs discards all the user selections in the current set. The Except for only allows to search and select the users to be excluded.Note: The user scoping enhancements are a requestable feature, VDEV-60004 and VDEV-61485 (Access certification micro frontend). To request this feature, contact your IBM Sales representative or IBM contact and indicate your interest in enabling this capability. You can also create a support ticket with the feature number if you have the permission. IBM® Security Verify trial subscriptions cannot create support tickets.After the campaign is created, you can click View condition set from the Scope section in the Access certification detail page to view the applied conditions. Also, when the campaign reviewer or supervisor opens the Certifications page from user launchpad > Task manager > Access certification tab > Review campaigns or Supervise campaigns, they can click the View condition set from the Scope section to view the applied conditions.
- Group scope
-
Typically, all groups that are entitled to the applications are included in the campaign. To limit the scope, you can specify the groups that you want to include in the campaign under Include only. All other groups are automatically excluded. Alternatively, you can list the groups to be excluded under Except for.
Note: In Group entitlement campaign type, you can either specify the inclusion or the exclusion list in the Group scope. - Account scope
-
The step is only displayed for Account entitlement campaign.
You can specify the type of accounts that are included in the campaign based on their compliance status. The default setting is to include all types of accounts. If you do not want to include a status type in the campaign, clear its checkbox.- Compliant
- Non-compliant
- Unmatched
- Orphaned
- Unmanaged
-
Specify the reviewer settings and then click Next.
- Select who is going to review the campaign.
- For user entitlement
- If you select User manager, a review notification is sent to the manager
of each user in the campaign.
If you select Specify reviewer, use the Search field to find and select a single reviewer for all the users in the campaign.
If you select Self, a review notification is sent to the users accessing the entitlements.Note: Self reviewer is a requestable feature, VDEV-41517 (Self Recertification in certification campaign). To request this feature, contact your IBM Sales representative or IBM contact and indicate your interest in enabling this capability. You can also create a support ticket with the feature number if you have the permission. IBM Security Verify trial subscriptions cannot create support tickets. - For group entitlement
- If you select Application owner, a review notification is sent to the
owner of each application in the campaign. The owner of each application must approve the campaign
before the entitlement is granted.
If you select Specify reviewer, use the Search field to find and select a single reviewer for all the groups in the campaign.
- For accounts
- If an account has a known user, the default setting is to have the certification reviewed by the
user's manager. If no user is associated with the account or no manager is listed for the user, the
review is made by the application owners.
If you select User manager or application owner, a review notification is sent to the manager of each user that is associated with an account in the campaign. If no manager is available to review the account, a notification is sent to the application owner.
If you select Specify reviewer, use the Search field to find and select a single reviewer for all the accounts in the campaign.
If you select Self, a review notification is sent to the users accessing the accounts.Note: Self reviewer is a requestable feature, VDEV-41517 (Self Recertification in certification campaign). To request this feature, contact your IBM Sales representative or IBM contact and indicate your interest in enabling this capability. You can also create a support ticket with the feature number if you have the permission. IBM Security Verify trial subscriptions cannot create support tickets.
- Determine when reviewers decisions take effect and then click
Next. If you checkmark the Only log reviewer's decisions checkbox, the reviewer action is not provisioned to the related target application. It is recorded on the IBM Security Verify logs for reporting and auditing purposes.
- When the campaign ends
- The decision takes effect at the end of the campaign. Decisions can be changed by selecting the Completed tab and expanding the menu next to the decision.
- Immediately
- The decision takes effect immediately and cannot be changed.
- Let the reviewer decide
- When the reviewer decides, the review can choose whether the decision takes effect immediately or at the end of the campaign. If immediately is selected, the decision cannot be changed.
- Select who is going to review the campaign.
- Specify whether to enable redirection to campaign supervisors and then click
Next. Campaign supervisors can help the campaign creator manage the progress of the campaign.
- Checkmark the Redirect to campaign supervisors checkbox.
- Use the Search field to select one or more supervisors to help with the campaign progress.
- Set the schedule for the campaign and then click Next.
- Select Run immediately and set Duration to the number of days that you want the campaign to run.
- Select Select a start date and set the start date and time. Set the Frequency to how often you want it to run, and set Duration to the number of days that you want the campaign to run.
Note: Duration refers to the time in which the reviewer must approve or reject the entitlements. - Set reminders for the campaign and specify what actions to take when the campaign
ends.
- Checkmark the Send reminders to reviewers checkbox.
- Specify when to start sending daily reminders to the reviewers before the campaign ends.
- Select what action to take on unreviewed entitlements at the end of the
campaign.
- Take no action
- This selection is set as the default action. The entitlement status remains unchanged. If the entitlement was previously approved for the user or group, it is still approved. If it was rejected, it remains rejected.
- Approve all
- This selection grants the entitlement to any unreviewed users and groups.
- Reject all
- This selection denies the entitlements to any unreviewed users and groups.
-
Click Schedule campaign.
The campaign is added to the Access Certification page.