Governance & Birthright Access

Scope

How to run identity governance in Portal: approval policies, HR sources, joiner, mover and leaver workflows, access reviews and the access graph.

Where the work happens

• Applications lists every access target. An application can have source, target or bidirectional connectors.
• Governance holds access packages, requests, approvals, grants, reviews, lifecycle workflows and the access graph.

Each person sees what their role allows. Requesters start on My Access. Approvers also see Approvals. Governance viewers and managers also see the catalog, grants, reviews, lifecycle, the access graph and policies.

Approval policies

• Who must approve: no approval, any one approver, a set number of approvers, or every approver.
• Deadline (optional): if nobody decides in time, keep waiting, ask the next approver, ask the requester’s manager, or ask a named person.
• Application owner: a rule can send each request to the owner of the requested application. If the application has no owner, the request stops, names the application, and raises an issue to fix. It never falls through to another approver.
• Peer auto-approval (off by default): approve automatically when enough of the requester’s peers already hold the package, for example 80%. It never applies to high-risk or critical access or when a separation-of-duties rule matches.

Approvers and requesters are notified in the Portal notification bell and by email.

HR sources

Connect an HR feed from Governance, Lifecycle, HR sources.

1. Connect: point Portal at a URL that returns JSON or CSV, or upload a file.
2. Map fields: Person ID and Email are required. Department, job title, manager, status and dates drive groups, movers and leavers. The sample shows what will happen to each person.
3. Review and enable: check the counts of accounts to create, update and offboard, then run the first import.

A URL feed syncs every 30 minutes by default, and no more often than every 5 minutes. An HR system with its own connector, such as Workday, is added under Applications first and then set up as an HR source.

Joiners, movers and leavers

• Joiners: Portal creates accounts for new hires automatically (on by default). It reuses an existing account only on an exact match of worker ID, email or employee ID. Anything less exact becomes an issue for you to resolve.
• Movers: after a transfer, Portal checks each package against its audience rule and revokes only the ones that no longer match. The run shows each package and the rule that decided it.
• Leavers: a leaver run removes grants, groups, roles, application access, sessions and guest access in your tenant. If it was a mistake, reactivate the person and select Reinstate access on the run. Governance grants are not restored; the person requests them again.

A failed step says why it failed, for example missing profile data, connector readiness or a credential. Fix the cause and retry. Retrying never creates duplicate access.

Access reviews

Create a campaign from Governance, Reviews with a scope, reviewers, a due date and remediation behavior. Reviewers are notified at launch and reminded two days before the due date. Self-review and reviewers from other tenants are blocked. A campaign closes only when every item is decided and required removals are complete. The export includes snapshots, decisions, who made them and when, and remediation results.

Access graph

Governance, Grants, Access graph explains why a person has access. Each line names the path, including nested group chains. To answer an auditor’s “who has access to this application” question, pick the target, run the query and select Export access. The CSV has one row per way each person holds the access. Each export is recorded in the audit log.