Skip to main content
All documentation

Identity governance and privileged access

Govern access requests, entitlements, reviews, role safeguards and time-limited privileged access with retained evidence.

Workflow
  1. Define boundaryChoose tenant, resource, owner, approver and business reason.
  2. Set safeguardsPreview assignment policy and separation-of-duties rules before publication.
  3. Request accessSubmit a scoped request with justification and duration for independent approval.
  4. Certify accessReview in-scope assignments, record decisions and verify remediation.
  5. End privilegeExpire or revoke temporary access and check audit evidence.

Requests and approval

Requests identify tenant, resource, role or entitlement, reason and validity period. Creation and approval are separate; self-approval and cross-tenant targets are blocked where required. A denied or expired request grants no access. Approvers use recorded need and policy outcome, not informal messages.

  1. Request the exact resource and enter reason and end date.
  2. Route to an authorised independent approver; confirm recorded decision.
  3. When work ends, revoke access and verify assignment is inactive.

Entitlements and packages

Catalogues and packages support versioned drafts, publication and rollback as a new version. User or group assignments can expire and require independent decisions. Legacy or assigned-only modes follow published application policy. Packages do not override tenant boundaries or SoD rules.

  1. Check package contents, owner and target application before editing.
  2. Validate and publish the reviewed version; confirm it is active.
  3. Request assignment with reason and expiry; check its resulting state.

Role hierarchy and SoD

Role hierarchy and separation-of-duties policies constrain access combinations. Simulate and version policies; exceptions have separate request, independent approval and revocation. Reparenting can affect descendants. Never broaden a role to bypass a conflict; keep exceptions narrow and time-bound.

  1. Simulate the proposed role combination against current tenant policy.
  2. Publish the reviewed policy and check expected conflicts.
  3. Request an exception with reason and duration; revoke it when no longer needed.

Reviews and campaigns

Access reviews certify memberships and assignments. Campaigns define a population, reviewers and deadline; reviewers decide each item. A decision and its later revocation are separate states. Follow overdue work through campaign status; silence is not approval.

  1. Create a tenant campaign with accountable reviewers and due date.
  2. Certify or revoke each item based on current need; record reasons.
  3. Check completion and verify remediation on the assignment itself.

PIM, step-up and emergency access

PIM eligibility is not active privilege. Activation can require reason, duration, approval and fresh user-bound or phishing-resistant step-up. Keep protected checks intact. Break-glass has a dedicated challenge and audit trail; it is not a routine workaround for missing roles or factors.

  1. Check eligibility, factor and permitted activation period.
  2. Complete genuine step-up and confirm the active role and expiry.
  3. End or expire access; review privileged session and audit state.

Workflows and evidence

Lifecycle workflows support triggers, actions, versions, approval, staged release, rollback and run monitoring. Validate and dry-run where offered. Runs can be paused, resumed, cancelled, replayed or approved when permitted. Audit exports, retention and legal holds govern evidence; preserve history when correcting a workflow.

  1. Validate the trigger and actions; dry-run and inspect impact.
  2. Request approval, stage and publish the intended version.
  3. Monitor run status; understand duplicate effects before replaying.

Frequently asked questions

Can I approve my own request?

No, where the workflow requires independent review; route it to another authorised approver.

Is a package assignment immediate?

It may await approval and remains subject to membership, expiry and policy.

What if SoD blocks access?

Review simulation evidence; request a narrow exception if policy permits it.

Is an eligible PIM role active?

No. Activate with required step-up, then verify its limited expiry.

Does review completion revoke access?

Check the assignment separately; a review decision and remediation are distinct.

Can I delete audit evidence after error?

No. Correct by new version or rollback and preserve audit history and holds.

Related pages