Certify unmanaged accounts

Certify unmanaged accounts to reduce drifts in access between Okta and the downstream app. This helps you reconcile identities in your org.

About this task

Early Access release

Create resource campaigns to certify unmanaged accounts. Unmanaged accounts are accounts that exist in a downstream app that Okta didn't assign, wasn't aware of, or accounts whose status differs from the matching identity in Okta. For example, an identity was deactivated in Okta but is still active in the app.

Before you begin

  • You are a super or access certifications admin.
  • Check that the Account reconciliation and Certify unmanaged accounts features are enabled for your org.
  • Read Best practices for creating campaigns.
  • Check that the apps you want to include in the campaign meet the following criteria:
  • Governance Analyzer won't generate insights or recommendations for campaigns that certify unmanaged accounts.
  • If you generate an auditor reporting package for a campaign that certifies unmanaged accounts, only the Campaign scope and Campaign actions reports are available.

Procedure

  1. In the Admin Console, go to Identity Governance > Access Certifications > Certification campaigns.
  2. Select Create campaign.
  3. Select Resource campaign.
  4. Configure the general settings for the campaign. See General settings.
  5. Click Next.
  6. On the Resources page, select Application as the campaign's resource scope.
  7. Select the apps to certify individually or by using governance labels.

    If you use governance labels, you can't use Okta Expression Language expressions to define a custom identity scope later.

  8. Toggle Review entitlements on and follow prompts on the page to define the scope. See Application settings.
  9. Click Next.
  10. On the Identities page, select Review unmanaged accounts.
  11. Select Review all unmanaged accounts or Custom (Okta Expression Language) and follow the prompts on the page.

    If you select Custom, you can use expressions that reference the app's imported user profile attributes for each app.

  12. Click Next.
  13. On the Reviewers page, assign reviewers for the campaign and follow the prompts on the page to configure fallback reviewer and other settings. See Configure reviewer settings.

    Unmanaged account campaigns support User, Group, and Resource owner reviewer types. Manager-based review isn't available, because an unmanaged account has no linked Okta identity to look up a manager from.

  14. On the Remediation page, specify what happens when a reviewer makes a decision. See Remediation settings and Understand remediation.
  15. Select Schedule.

Okta generates one review item for each entitlement held by an unmanaged account when the campaign launches and assigns it a reviewer. Each review item shows the account's status in both Okta and the app along with other details, so reviewers have context for accounts that they might not personally recognize.

When a reviewer approves or revokes an entitlement, the decision is scoped to that entitlement, not the underlying account. Revoking all of an account's entitlements doesn't deactivate the account.

Troubleshooting

If you run a campaign within seven days of another campaign's end date, you may see unmanaged accounts in the new campaign, even if the access was revoked in the previous campaign. This is because Okta refreshes the data for unmanaged accounts every seven days. You can confirm that the unmanaged account's access was revoked in the source app.