Share all details about your problem, including any error messages you may have received.
Hi,
I’m trying to create a custom Rule to define the certifiers for a Targeted Certification, which aims to certify Active Directory entitlements.
The desired behaviour is:
Send the item to the manager, but if the manager is a VIP user (defined by a attribute on the identity itself), send it to the entitlement owner.
The problem seems to be that the Rule operates at the CertificationEntity level not and not at the CertificationItem level.
Hello Tiago. I would suggest splitting this into two Targeted Certifications. Since the Certifier rule works at the CertificationEntity level, it is not really intended for routing individual entitlement items to different owners.
Since your VIP condition is based on the manager identity, you could split it like this:
Cert A: identities whose manager is not VIP → Primary Certifier = Manager
Entitlement Owner is supported for Additional Entitlements in Targeted Certifications, so those entitlements should route to their respective owners without needing a custom Certifier rule (Choose Certifier docs).
For separating the two populations, a CertificationScheduleEntitySelector rule under Who to Certify should be a good fit (Who to Certify docs).
I would also handle identities with no manager explicitly in the selector so it is clear which certification should include them.
I would also configure a Backup Certifier on both certifications, since IIQ requires one for Manager and Owner primary-certifier types and uses it when the primary certifier cannot be resolved.