In Saviynt, Enterprise Roles are specifically designed to encompass entitlements that span multiple applications. This is in contrast to Application Roles, which are limited to entitlements within a single application.

Enterprise Roles: Provide a way to group entitlements across different applications, reflecting a user's overall job function or responsibilities within the organization. This is essential for managing access for users who need permissions in various systems to perform their duties.

Other Role Types:

Application Role: Grants permissions specific to a single application.

Transactional Role: Focuses on granting permissions for specific tasks or transactions within an application.

Enabler Role: Provides supplementary permissions that enhance or support other roles.

Saviynt IGA Reference:

Saviynt Documentation: The section on Role Management within Saviynt's documentation clearly defines the different role types and their purposes.

Saviynt Training Materials: Saviynt's training courses emphasize the importance of Enterprise Roles in managing cross-application access.

To have multiple users as Campaign Owners for a User Manager Campaign in Saviynt, the appropriate configuration is to B. Create a user group and choose the user group as the Campaign Owner. Here's the explanation:

Saviynt's User Groups: User groups are collections of users that can be used for various purposes, including assigning roles, permissions, and ownership.

Campaign Owner as a User Group: Saviynt allows you to specify a user group as the owner of a campaign. This means that all members of the group will have the same campaign ownership permissions.

Benefits of Using a User Group:

Simplified Management: It's easier to manage a group of users than to assign individual users as campaign owners.

Flexibility: You can easily add or remove users from the group to adjust campaign ownership as needed.

Shared Responsibility: All members of the group share responsibility for managing the campaign.

Why Other Options Are Less Suitable:

A . Create a user Query and add users: While you can use queries to select users, directly using a user group is a more standard and manageable approach for assigning multiple campaign owners.

C . Create a Roles Query and add Roles of various users: Roles are typically used for granting access rights, not for defining campaign ownership.

D . Create an Organization Query and add users: Organization queries are related to the organizational structure and are not the best way to define a group of campaign owners.

In conclusion: Using a user group as the Campaign Owner in Saviynt provides a flexible and manageable way to assign multiple users as owners, simplifying administration and promoting shared responsibility for campaign management.

Given that an Admin launched a Role Ownership Campaign for you in Saviynt, the option you can not certify is A. Role Ownership. Here's why:

Saviynt's Role Ownership Campaign: This type of campaign is specifically designed for reviewing and certifying the ownership of roles, not the other aspects of a role.

Your Role as Certifier: In this scenario, you are the designated reviewer for role ownership. This means you are responsible for confirming who should be the owner of specific roles.

What You Can Certify in a Role Ownership Campaign:

Confirm or Change Role Owner: You can confirm that the current role owner is correct or assign a new owner.

What You Cannot Certify in This Campaign:

A . Role Ownership: You are the one certifying role ownership, so you cannot certify your own action of assigning an owner. It would be a circular process.

B . User membership of the Role: This is typically reviewed in a User Access Campaign or a Role Membership Campaign.

C . Delete Role: Role deletion is an administrative action, not typically part of a Role Ownership Campaign.

D . Associated Entitlements: Entitlement certification is usually handled in an Entitlement Owner Campaign or as part of a broader User Access Campaign.

In essence: A Role Ownership Campaign focuses solely on validating and assigning role owners. Other aspects of role management, such as user membership or associated entitlements, are handled in different campaign types or through separate administrative actions. As the certifier in this specific campaign, you cannot certify the very action you are performing, which is assigning role ownership.

To automatically deprovision birthright access when the defining condition fails, the correct option is C. Remove the birthright Access if the condition fails under the created Rule. Here's a detailed explanation:

Saviynt's Birthright Access (Automatic Provisioning): Saviynt allows administrators to define rules that automatically grant access (birthright access) based on user attributes or other criteria (e.g., new hires in a specific department automatically get access to certain applications).

Rule-Based Access Management: These rules are a core part of Saviynt's access management capabilities, allowing for dynamic and automated provisioning.

'Remove the birthright Access if the condition fails': This option, typically found within the birthright rule configuration itself, is crucial for ensuring that access is revoked when the conditions that granted it are no longer met.

Example: If a user is granted access to an application because they are in the 'Sales' department, and they are later moved to the 'Marketing' department, the condition for the birthright rule would fail, and Saviynt would automatically deprovision the access.

Saviynt's Continuous Monitoring: Saviynt continuously monitors user attributes and rule conditions. When a change occurs that causes a condition to fail, the deprovisioning action is triggered.

Other Options:

A . Remove the Access Rule: This would remove the entire rule, preventing it from granting access to anyone, not just the user whose condition has failed.

B . Apply a new Technical Rule to remove the Access: While technically possible, it's less efficient and more complex than using the built-in option within the birthright rule.

D . Use the Request Rule: Request Rules are for access requests, not for automatically provisioning or deprovisioning birthright access.

To implement a workflow involving a Saviynt User Group's approval, the appropriate workflow block is B. TASK Access Approve. Here's an explanation:

Saviynt's Workflow Engine: Saviynt's workflow engine allows for the creation of complex approval processes using various building blocks or activities.

TASK Access Approve: This specific activity is designed to handle approval steps within a workflow. It allows you to define who the approver(s) should be and how the approval should be processed.

User Group Approval: To implement approval by a Saviynt User Group, you would configure the 'TASK Access Approve' activity as follows:

Approver Type: You would select 'User Group' as the approver type.

User Group Selection: You would then specify the particular Saviynt User Group that should be responsible for the approval.

Approval Logic: You can define whether all members of the group must approve, or if a certain number or percentage of approvals is sufficient.

Saviynt User Groups: User Groups in Saviynt are collections of users, often based on department, role, or other criteria. They are useful for managing access and approvals at a group level.

Other Options:

A . CONDITION IF Else: This block is used for branching logic in a workflow, not specifically for assigning approvals to user groups.

C . Action Prompt: This might be used for displaying information or collecting input, but not for defining an approval step.

D . TASK Custom Assignment: While you could potentially use custom assignment with scripting to achieve user group approval, the 'TASK Access Approve' activity provides a more straightforward and built-in way to do it.

In conclusion: The 'TASK Access Approve' workflow block in Saviynt, configured with a User Group as the approver type, is the most appropriate and direct way to implement a workflow that requires approval from a specific Saviynt User Group.