Manage separation of duties rules

After you modify or delete an SOD rule, the change affects all scheduled campaigns and new access requests that a user submits. Active campaigns and access requests submitted before the SOD rule change aren't impacted.

Before you begin

Sign in as a super admin or an admin with the Manage separation of duties (SOD) risk rules and Manage applications permissions. A custom role must have a resource set that includes the Risk Rules resource type. See Custom admin roles, Role permissions, and Create a resource set.

Edit a rule

In the Admin Console, go to Applications and Resources > Applications.
Find and select the app to create an SOD rule for.
Go to Governance > Separation of duties.
Find the rule that you want to edit and select Edit from its menu.
Make your changes to the rule and then click Save.

For group rules, you can change the name, description, note, and the groups in either list. Each list must keep at least one group. Changes take effect right away for access requests and campaigns.

If you delete a group from Okta, it's automatically removed from any group rules that include it. If a list in a rule is left empty, the rule is marked as invalid and isn't evaluated. Okta writes a system log event when this happens. Edit the rule to add a group to the empty list, or delete the rule.

Enabling Governance Engine on an app that has group rules pauses those rules. Disabling Governance Engine on the app turns them back on.

Delete a rule

In the Admin Console, go to Applications and Resources > Applications.
Find and select the app whose SOD rule you want to delete.
Go to Governance > Separation of duties.
Find the rule that you want to delete and select Delete from its menu.
Click Delete rule to permanently delete the rule.