Having the ability to review administrative roles is a security must to deliver the most impactful access certification reviews for Okta tenants, which protects or manages access to the most sensitive resources in the organization. Here’s how to create those administrative roles for Campaigns with OIG.

Overview

Admin role-centric access certification campaigns enable organizations to align the need for admin access privileges with the principle of least privilege, granting users only the admin access required to fulfill their day-to-day operational work or responsibilities. This approach minimizes the risk of standing admin roles, access, insider threats, and data breaches by tailoring admin permissions to an individual's role and responsibilities.  

Applies To

• Access Certifications

Solution

  To create a new Access Certification:

1. Log into Okta as an Administrator with the Access Certification role or Super Admin.
2. Select the Identity Governance menu.
3. Select the Access Certification application.
4. Locate and click the blue + Create campaign button.
5. Select Resource Campaign.
6. Fill out each step to create a campaign.

Create campaign screen

Step 1: General

1. Enter the name of the campaign.
2. Enter an optional description.
   1. The description is visible to the reviewer and can be used as part of a verification rule.
3. Select the Start date / Start time and time zone.
4. Select the Duration of time the campaign will run.  NOTE:  A duration of at least 8 days is required as a minimum to support multiple levels of reviewers.
5. Select Make this recurring and set up those related options as needed if desired.
6. Click the Next button.

Step 2: Resources

Option: Applications

1. Select Applications from the dropdown.
2. Enable Review entitlements toggle button.
3. Use the Select application box to pick Okta Admin Console as an application.
4. Use the Select Scope box to pick an option of All entitlements and Bundles or select Specific entitlements and bundles to limit the campaign scope.

5. Click Next.

Step 3: Users

Select the user's scope for this campaign. The options are:

• Option 1: All users assigned to the selected resources
• Option 2: Specify users in scope

1. Select Specify user scope.
2. Use the Scope Users box to type in an Okta Expression to identify users based on Okta Expression Language.  Feel free to click Sample expressions or the Okta Expression Language guide as a reference.
3. Click Next.

Step 4: Reviewer

The multi-level reviewer offers some of the same types of possible reviewers but now includes more than the single-layer reviews.

NOTE:  If reviewing Applications, the Group Owner will be grayed out as that is not a supported review type. Also, the same person cannot be both a reviewer and a reviewer.  

1. Select the First-level reviewer by clicking the appropriate box on the screen.  

NOTE: Options applicable to the selected reviewer will be displayed. Clicking the Pencil icon to the right of the reviewer type will bring back to the previous selection screen.  

2. Select Preview Reviewer and verify the settings.

For Multi-level Reviewer setup:

1. Click + Add level.
2. Follow the same steps for the Single Level reviewer above, except for the Reviewer type, which cannot be reused if selected in the first level review.  
3. Select Preview 2nd level Reviewer and verify the settings.

When multi-level reviews are configured, Additional Settings are available to configure.  

4. Select the option for which decision go to the second level.

These settings allows to define which decisions may or may not be reviewed by the second-level reviewer and when the second-level review should start.  

Second-level reviewers will have visibility into only items moving onto the second level. When the second-level reviewer should see all items, it is recommended to pass on both approved and revoked decisions.

NOTE: Reviews less than 8 days will not support a second-level review flow. The system will mark as overdue any items not completed by the first-level reviewer before the second-level review starts. Enabling overdue notifications is suggested to quickly alert reviewers and encourage prompt completion.

5. Expand the Notification settings section.

6. Select the notifications for this campaign.
   1. The Remove Level button on the screen reverts the campaign to a single-level review.
7. Click the Next button.

Step 5: Remediation

1. Select the appropriate remediation steps by selecting the appropriate radio button.

2. Click the Schedule Campaign button to finish creating the campaign.
3. From there, wait until the scheduled start time, or as an Admin, Launch, Edit, or Delete a scheduled campaign.

Related References

• Access Certification
• Multi-level reviewers