Certifications, Policies, and Compliance Governance
Certification building blocks
A certification definition describes what to review: a population (identities, accounts, entitlements, roles) and an owner type (manager, application owner, entitlement owner, role owner, or a targeted reviewer). Launching the definition creates a campaign composed of certification items. Campaigns move through phases; items carry decisions such as approve, revoke, mitigate, or allow exception. Sign-off closes the campaign, and revocation only becomes real access removal once remediation runs and provisioning executes.
Policies and violations
Identity policies express rules about acceptable access - for example, segregation-of-duties combinations or access to a sensitive entitlement. Policy checks run in a scheduled task and create policy violation objects; violations can be mitigated with an expiry, which is itself something to monitor. Advanced policies express the intent declaratively; rule-based policies use a policy violation rule that returns the violation details.
Traps
- Assuming an approved campaign revokes access automatically, when remediation configuration and successful provisioning are also required.
- Reviewers who never resolve to an owner, leaving items unassigned and campaigns stuck in staging.
- Treating a mitigated violation as gone; mitigation expires.
- Forgetting that violations are only as fresh as the last policy check task run.
- Bulk decisions applied to the wrong scope because the campaign's population was defined loosely.
Rule of thumb
Trace the chain: definition, campaign, item decision, remediation, provisioning evidence. If any link is missing, the compliance story is incomplete even though the UI shows approved.