Hello,
We noticed that INACTIVE_LONG_TERM identities are currently included in certification campaigns created through the Search tab.
Is there a way to exclude them? Will this functionality be available in a future release?
Thanks
Hi @l_pulignano
As INACTIVE_LONG_TERM configuration is linked to lifecycle state, you can exclude identities with those lifecycle in your campaign by using search filter like for example :
(NOT (attributes.cloudLifecycleState:inactive))
Hi,
The campaign needs to be scheduled, so using this type of filter in the search section won’t work. It would only return the identities and their permissions at that specific moment. If anything changes afterward, those updates will not be reflected.
For scheduled campaigns, the query is run at each scheduled period. This means that if you schedule it to run monthly, after the initial configuration the query will be executed again each month to reflect the most up-to-date identities.
Hello Luana,
Honestly, as best practice, you should also recertify the accesses for inactive identities, those identities shouldn’t have any permission on any account. But if you want not to see them, you should add the (NOT (attributes.cloudLifecycleState:inactive)) statement on the search
Hi @l_pulignano ,
Could you please confirm general information on what is the exact requirement or search query you used?
As per the best practice of generating campaign through search, more refined the search query is, more accurate will be the inclusion of users in it.
Kind regards,
Aayush