Manage resource collection assignments

You can manage resource collection assignments in two ways:

• Direct assignment: Assign a collection to individual users, unassign it, and set an expiration for each assignment.
• Collection policy: Define a policy for a collection that automatically assigns the collection to all users who match the criteria that you specify.

Users with any of the following statuses can be assigned to a collection:

• Active
• Staged
• Locked out
• Password expired
• Password reset

Manage direct assignments

Use direct assignment to give specific users access to a collection, or to give access that expires.

Assign a resource collection to a user

1. In the Admin Console, go to Identity Governance > Resource Collections.

2. Search for the collection and click View.
3. Click the Assignments tab and then click Assign users.
4. Search for the user to whom you want to assign the collection and click their entry. Their name is added to the list of selected users.
5. Optional. Repeat the previous step to assign more users to the resource collection.
6. Click Save. A message appears to confirm that the collection is assigned to the user.

Unassign a resource collection from a user

1. In the Admin Console, go to Identity Governance > Resource Collections.

2. Search for the collection and click View.
3. Click the Assignments tab.
4. Search for the user to unassign and click Unassign from their action menu.
5. Click Unassign. A message appears to confirm that the collection was unassigned from the user.

Set an expiration for a resource collection

Follow these steps to set the time after which a user loses their access to a resource collection. You can set an expiration only for users who were assigned the collection directly. To remove access that a collection policy grants, edit the policy's assignment rule.

1. In the Admin Console, go to Identity Governance > Resource Collections.

2. Search for the collection and click View.
3. Click the Assignments tab.
4. Search for the user and click Edit expiration from their action menu.
5. You can choose to have the user never lose access or have their access expire after a specific date and time.
   • Select Never to allow the user to always access the collection.
   • Select On to set an expiration date and time after which the user loses access to the collection. Enter the date, time, and time zone of the expiration. The Assignment Source column of the Assignments tab displays the remaining time before a user's access expires.
6. Click Save.

Manage collection policies

A collection policy automatically assigns a resource collection to every user whose profile attributes match the criteria that you define. Users get access automatically when their profile attributes match the criteria, so an admin doesn't have to assign the collection to each user.

How collection policies work

• Each collection can have one policy, and each policy has one assignment rule.
• An assignment rule contains up to 10 conditions. Each condition is based on a user profile attribute, such as Department, Cost center, or Last name.
• Conditions in an assignment rule are joined by AND. A user must match every condition to be assigned the collection.
• Within a condition, you can specify up to 50 values. These values are joined by OR. A user matches a condition if their attribute matches any of the condition's values.
• Okta assigns the collection to users who match the assignment rule.

Create a collection policy

1. In the Admin Console, go to Identity Governance > Resource Collections.

2. Search for the collection and click View.
3. Go to the Collection policy tab.
4. Click Add rule.
5. Enter a name for the assignment rule.
6. In the User scope section, select a user profile attribute, such as Cost center. Select an operator, such as Is, enter a value, and then select Enter. The value appears with an x that you can click to remove it.
7. Optional. Enter another value for the condition and select Enter. Each value that you add is an OR match for that attribute.
8. Optional. Click Add condition to add another attribute and values.
9. Optional. In Preview user, select a user, and then click Preview to check whether the user is included in the user scope.
10. Click Save.

Edit a collection policy

You can edit an existing collection policy to make updates as needed.

1. In the Admin Console, go to Identity Governance > Resource Collections.

2. Search for the collection and click View.
3. Go to the Collection policy tab.
4. Edit the conditions or values in the assignment rule.
5. Optional. In Preview user, select a user, and then click Preview to check whether the user is included in the user scope.
6. Click Save. Users assigned through the policy whose attributes no longer match are unassigned, and users whose attributes now match are assigned the collection.