Roles and groups reports

Roles

Select one or more roles to include in the report.

User ID

Type a profile ID to only display role assignments for the specified user. Alternatively, you can search for one or more profile IDs.

Role assignment attributes to display

Select one or more role membership attributes to include in the report.

Role assignment attributes

Select a role membership attribute on which to filter. You can select up to four attributes. The union of all attributes configured will be returned.

Summarize report

Select this checkbox to show summary information for each role.

Minimum number of users

Filter out rows that have less than the specified threshold value for number of users with the role. This option is only available if Summarize report is selected.

Graph type

Select a type of graph to generate for the report. This option is only available if Summarize report is selected.

Number of rows for graph

The maximum rows for graph to display. The selected rows will be displayed with the number of entitlements in descending order.

Roles

Select one or more roles to include in the report.

Managed groups

Type the long ID of one or more managed groups for which you want to run the report. Only roles that contain the specified groups are included in the report. All groups are included by default. Alternatively, you can search for one or more managed groups.

Template accounts

Select one or more template accounts. Only roles that contain the specified template accounts are included in the report.

Sub-roles

Select one or more sub-roles. Only roles that contain the specified sub-roles are included in the report.

Resource attribute

Filter results using a resource attribute and criteria. The type of criteria is dependent on the attribute selected. Up to four resource attribute filters can be defined.

Resource attribute to display

Choose which resource attributes to display.

Necessity

Select the necessity (Required, Optional, Legacy), to only include role-members with the specified necessity. The default is Show all.

Show authorizer

Select this checkbox if you want generate a report listing the authorizers for each matching role.

Show deprecated

Select this checkbox to include only deprecated roles in the report.

Summarize report

Select this option to summarize the report.

In this mode, the report includes a count of the number of members and authorizers for each matching role.

Roles

Select one or more roles to include in the report.

User ID

Type in the console user to audit.

Choose date range

Choose a date range for role operations.

Operation

Select one or more operations that you want an audit report for. Default is all operations.

Roles

Select one or more roles to include in the report.

Minimum number of users

Filter out rows that have less than the specified threshold value for number of users with the role.

Lower bound on the average number of out-of-role entitlements held by users in the role

Filter out rows that have less than the specified threshold value for average number of out-of-role (surplus) entitlements.

Summarize report

Select this checkbox to summarize the report details.

Roles

Select one or more roles to include in the report.

Segregation of duties rules

Select one or more SoD rules to include in the report.

Group ID

Search for the group you want to report on. Alternatively, you can type the long ID of a group or a pattern of group IDs using wildcard characters, '*' representing any string of characters and '?' representing any single character. All groups are included by default.

Report type

Select a report type:

Override authorization configuration

Select a override type:

Resource attribute to display

Available for the all report types except Show unmanaged groups report type. Choose which resource attributes to display alongside the managed groups.

Member type

Only available for the Show managed group members report type. Select the member types to display:

Minimum depth

Only available for the Show managed group members report type. The report will only output members that have a depth greater than or equal to this value. The default value is 1.

Depth indicates what level of membership an account or group has to the managed group. A depth of 1 means they are a direct member of the group. A depth of 2 means they are a member of a direct child group.

Maximum depth (-1=infinite)

Only available for the Show managed group members report type. The report will only output members that have a depth less than or equal to this value. A value of -1 means it will output all members that have a depth greater than or equal to the Minimum depth. The default value is -1.

Target system ID

Type a comma-and-space-delimited list of target system IDs for which you want to run the report. Alternatively, you can search for one or more target systems.

Include invalid groups

Include or exclude groups that may have become invalid during the last auto discovery.

Only include groups without direct owners

Presented only when report type is set to Show managed group and authorization summary . When this option is enabled only groups without direct owners will be listed. Owners via groups that own a subgroup are not considered as direct owners.

Include deleted memberships

Include deleted group memberships in the results. This option is only available for the Show managed group members report type, and will only return the most recent deletion from each group, per user.

Membership deleted by:

Filter results when including deleted memberships to only include deletions initiated from a specific source.

Resource attribute

Filter results using a resource attribute and criteria. The type of criteria is dependent on the attribute selected. Up to four resource attribute filters can be defined.

Report type

Select a report type:

Leaving it blank is the same as selecting all types.

Display operations

Select an operation:

Leaving it blank is the same as selecting all operations.

Resource attribute to display

Select resource attributes to be displayed in report.

Time range

Select time range.

Resource attribute

Filter results using a resource attribute and criteria. The type of criteria is dependent on the attribute selected. Up to four resource attribute filters can be defined.

Authorizer ID

Type a comma-and-space-delimited list of authorizer IDs. Alternatively, you can search for one or more authorizers.

Requester ID

Type a comma-and-space-delimited list of requester IDs. Alternatively, you can search for one or more requesters.

Managed groups

Search for the group you want to report on. Alternatively, you can type the long ID of a group or a pattern of group IDs using wildcard characters, '*' representing any string of characters and '?' representing any single character. All groups are included by default.

Group owner

Type a comma-and-space-delimited list of group owners. Alternatively, you can search for one or more group owners.

User ID

Search for one or more users for which you want to run the report. All users are included by default. Alternatively, you can type the short ID of a user or a pattern of user IDs using wildcard characters, '*' representing any string of characters and '?' representing any single character

Group ID

Search for the group you want to report on. Alternatively, you can type the long ID of a group or a pattern of group IDs using wildcard characters, '*' representing any string of characters and '?' representing any single character. All groups are included by default.

Target system ID

Type a comma-and-space-delimited list of target system IDs for which you want to run the report. Alternatively, you can search for one or more target systems.

User attributes to collect users into peer groups

Select at least one attribute to collect users into peer groups. A peer group is a group of users with some attribute in common; for example, users working at the same location or department, or having the same manager.

Minimum size of a user peer group

Specify the size of a peer group. If a peer group has fewer members than this, their entitlement consistency will not be calculated. Instead, an information icon will be displayed in the consistency column for these users in the report. Default value is 2: The value should be 2 or greater.

Mark items as inconsistent if fewer than this percent of peers share the item

Edit the value to determine how out-of-pattern entitlements will be highlighted. By default, if consistency calculations are enabled and fewer than 20% of users share an entitlement, it will be highlighted in the review.

Mark items as consistent if at least this percent of peers share the item

Edit the value to determine how in-pattern entitlements will be highlighted. By default, if consistency calculations are enabled and at least 80% of user share an entitlement, is will be highlighted in the review.

User ID

Search for one or more users for which you want to run the report. All users are included by default. Alternatively, you can type the short ID of a user or a pattern of user IDs using wildcard characters, '*' representing any string of characters and '?' representing any single character.

Group ID

Search for the group you want to report on. Alternatively, you can type the long ID of a group or a pattern of group IDs using wildcard characters, '*' representing any string of characters and '?' representing any single character. All groups are included by default.

Profile attribute

Filter results using a profile attribute and criteria. The type of criteria is dependent on the attribute selected. Up to two profile attribute filters can be defined.

User attributes to display

Select user attributes to display in reports.

Membership attributes to display

Select attributes on group account membership or child group membership to display in reports.

Member type

Select the member types to display:

Membership type

Select the membership types to display:

Target system ID

Type a comma-and-space-delimited list of target system IDs for which you want to run the report. Alternatively, you can search for one or more target systems.

Include deleted memberships

Include deleted group memberships in the results.

Include invalid users and accounts

Include or exclude users and accounts that may have become invalid during the last auto discovery.

Membership attribute

Filter results using a membership attribute and criteria. The type of criteria is dependent on the attribute selected. Up to two membership attribute filters can be defined.

Resource type

Select a resource type:

Group ID

If Resource Type "Managed group" is selected, search for one or more managed groups for which you want to run the report. Alternatively, you can type the long ID of a managed group.

Roles

If Resource Type "Role" is selected, search for one or more roles for which you want to run the report. Alternatively, you can type the ID of a role.

Type of variance

Select an auto assignment deviance type:

Auto-assignment status

Select an auto-assignment status:

Profile attribute to display

Select the profile attributes to show for each user listed.

Summarize report

Select this option to summarize the report.

In this mode, the report includes a count of the number of members and members not in compliance for each selected resource.

Resource type

Select a resource type:

Group ID

If Resource Type "Managed groups" is selected, search for one or more managed groups for which you want to run the report. Alternatively, you can type the long ID of a managed group.

Roles

If Resource Type "Roles" is selected, Search for one or more roles for which you want to run the report. Alternatively, you can type the ID of a role.

Auto-assignment status

Select an auto-assignment status:

Minimum deficits remaining

Only display resources with the minimum number of deficits remaining.

Minimum deficits requested

Only display resources with the minimum number of deficits requested.

Minimum surpluses remaining

Only display resources with the minimum number of surpluses remaining.

Minimum surpluses requested

Only display resources with the minimum number of surpluses requested.

Resource type

Select a resource type:

Group ID

If Resource Type "Managed group" is selected, Search for one or more managed groups for which you want to run the report. Alternatively, you can type the long ID of a managed group.

Roles

If Resource Type "Role"is selected, Search for one or more roles for which you want to run the report. Alternatively, you can type the ID of a role.

Auto-assignment status

Select an auto-assignment status:

User ID

Type a user's profile ID to only list the surpluses and deficits that apply to that user. Alternatively, you can search for one or more profile IDs.

Type of variance

Select an auto assignment deviance type:

Auto-assignment status

Select an auto-assignment status:

Profile attribute to display

Select the profile attributes to show for each user listed.

Summarize report

Select this option to summarize the report.

In this mode, the report includes a count of the number of roles and groups that may be surplus or deficient for each user selected.

Minimum number of total surpluses

Filter out rows that have less than the specified threshold value for number of surpluses with the role.

Graph type

Select a type of graph to generate for the report.

Number of rows for graph

The maximum rows for graph to display. The selected rows will be displayed with the number of entitlements in descending order.

Data set 1 label

Type a label for data set 1.

Assignment by role (data set 1)

Select:

Assignment by policy (data set 1)

Select:

Assignment source (data set 1)

Select:

Date (data set 1)

This is the date when the group membership was added. Choose one of the following options to define a date range:

Data set 2 label

Type a label for data set 2.

Assignment by role (data set 2)

Select:

Assignment by policy (data set 2)

Select:

Assignment source (data set 2)

Select:

Date (data set 2)

This is the date when the group membership was added. Choose one of the following options to define a date range:

Graph type

Select a type of graph to generate for the report.