Access Reviews Global Settings

Customizing Access review behavior for specific business needs and use cases.

Access Reviews settings can be customized to fit the needs of individual organizations and use cases, such as enabling auto-expiration, setting whether all rows need a decision before review completion, or requiring a note with certain decisions. You can also manage how Veza integrates with a corporate identity provider (IdP) to enable single sign-on and least-privilege review flows. See the following sections for more information:

Some of these options must be enabled by the Veza support team, while others can be configured using an API. See Global Settings APIs for detailed API documentation.

Suggest reviewers from a global identity provider

When selecting reviewers for a new review or re-assigning row-level reviewers, you will choose, by default, from the list of Veza local users. This includes all local admin, operator, and reviewer root team users. External users from your identity provider are also shown, if they have already logged in with single sign-on and have an appropriate role.

By configuring a global identity provider, you can select reviewers from all users in your organization that Veza has discovered within an integrated IdP, including users who have never logged in to Veza. This eliminates the need to create user accounts for reviewers before they can be assigned to rows.

For example, if your organization's Okta domain is integrated with Veza and single sign-on (SSO) is enabled for your Veza tenant, all the domain's Okta Users will be suggested as possible reviewers. Those employees can then log in to Veza with SSO to complete their assigned reviews.

To enable a global Access Reviews Identity Provider, see Configuring a Global Identity Provider. Enabling a global identity provider also enables reviewer auto assignment to Managers and Resource Owners.
If notifications are enabled for a configuration or review, any new reviewers are notified by email, with a link to log in and make decisions on their assigned rows.
When using a global identity provider, it may be preferable for external users to have the Reviewer role assigned by default, preventing unauthorized access to other Veza functionality. You can change the default role under Sign-in Settings: Default Roles.

Reviewer auto-assignment

You can choose to auto-assign managers and resource owners when creating a review or re-assigning reviewers. Any rows in the review that cannot be auto-assigned are assigned to fallback reviewer(s).

To enable Veza to automatically identify managers and resource owners, see Managers and Resource Owners:

Within your IdP, set the corresponding manager property on the user object
Within Veza, add a Veza Tag that identifies a resource owner.

When an integrated Identity Provider (IdP) is configured as the global identity provider, these managers and resource owners can sign in to Veza without first needing to create an account.

Auto-assignment takes place during review creation. To inform reviewers who are auto-assigned when creating the review, ensure that notification emails trigger "When a review is started" in the review Notification Settings.

Self-review prevention

You may want to prevent reviewers from being able to review and sign off on their own access in a review. When self-reivew prevention is enabled and a Global IdP is configured, users cannot be assigned to review rows for identities that match their global unique ID:

Users with an ID that correlates to a review row cannot be assigned as reviewers for that row: "john@cookie.net" cannot be assigned as a reviewer for any row in a review involving Okta User "john@cookie.net."
Users cannot be assigned to review access for local user accounts for which they're the top-level identity (if Veza has detected a correlation between an IdP User with id john@cookie.net and the local Snowflake User jsmith, IdP User john@cookie.net won't be allowed to be a reviewer for any rows that involve his local Snowflake User account jsmith.
Self-review prevention, as well as the deny list, applies when auto-assigning reviewers during review creation.

Self-review prevention can be enabled or disabled via API. Possible settings are:

SELF_REVIEWER_CHECKING_DISABLED (default)
SELF_REVIEWER_CHECKING_ENABLED

Self-review prevention with auto-assignment

When auto-assigning reviewers, operators can specify a list of fallback reviewers. These users are assigned when self-review rules or the deny list would prevent the original assignment. They are also used when a manager or owner can’t be found.

If a fallback reviewer is prevented from reviewing their own access or is on the deny list, the other fallback reviewers are assigned to the row.

If there are no fallback reviewers and a rule prevents an assignment, Veza will select a reviewer in the following order:

The blocked user’s manager or resource owner (if not explicitly inactive)
The configuration creator
A Veza system administrator.

See Reviewer Selection Methods to customize this behavior.

Review completion settings

Depending on how your organization conducts access reviews, you may prefer that users be able to complete reviews at any point, or want reviews to autocomplete when certain requirements are met.

Autocompletion

By default, a review must be manually marked "complete" once a reviewer has signed off on all decisions. This setting can be changed so that reviews move are considered complete once a reviewer signs off on the final row. You can also customize autocomplete behavior to allow or prevent autocompletion of reviews that contain "Rejected" decisions.

This behavior is customizable using an API.

Example request:

{"value":"COMPLETION_ALLOWED_ALL_ROWS_HAVE_NON_REJECT_DECISION"}

Possible values are

COMPLETION_ALLOWED_ALL_ROWS_HAVE_DECISION (default): Once all rows have a decision, the review will be automatically marked as complete and no further changes can be made.
COMPLETION_ALLOWED_ANYTIME Any reviewer can click Complete to finish and close the review at any point.
COMPLETION_ALLOWED_ALL_ROWS_HAVE_NON_REJECT_DECISION autocompletion occurs only when all rows were signed off as approved or were rejected but marked as “fixed.”

When an option other than COMPLETION_ALLOWED_ANYTIME is selected, reviewers will not have the option to manually Complete Review from the user interface, and empty reviews (ones created with no results) will always autocomplete.

Auto Complete Settings determine whether reviews automatically move to "completed" status once the deadline is passed. Possible values are:

AUTO_COMPLETE_DISABLED (default)
AUTO_COMPLETE_ENABLED

Example request:

{"value":"AUTO_COMPLETE_ENABLED"}'}

Enable or disable review expiration

When enabled, all reviews will move to the EXPIRED status and become read-only once 24 hours have passed since the due date. Possible values are true or false (default). This behavior is customizable using an API.

Requiring notes with decisions

By default, adding a note is optional when making decisions on rows. However, you may prefer that reviewers be required to leave a note under certain conditions. For example, you could require a note for rejected rows, while prompting (but not requiring) a note for approved rows.

Notes pop-up behavior sets whether the "Notes" modal appears and if a note is required when making decisions on rows. "Approve" and "Reject" behavior can be customized separately:

Approved notes behavior:
- No pop-up (default)
- Optional
- Required
Rejected notes behavior:
- No pop-up (default)
- Optional
- Required

This behavior is customizable using an API.

Example request:

{
  "value": {
    "accept_notes_behavior": "POP_UP_OPTIONAL",
    "reject_notes_behavior": "POP_UP_REQUIRED"
  }
}

When "No pop up" is selected, no prompt is shown, and notes must be added by clicking Add Note. Otherwise, a note will be required or optional depending on the decision.

Change default columns and sorting

An administrator can customize row sort order and the default columns shown in reviewer interface. Columns can be customized globally and per configuration. New reviews will use the default columns for the parent configuration.

See Customizing Default Columns for more information about the possible columns and API documentation.

The following example sets global default columns based on the source, destination node, and intermediate (waypoint) node properties, and shows each row's reviewers:

{
  "value": {
    "default_ordered_columns": [
      "source.customprop_worker_status",
      "source.name",
      "concrete_perms",
      "destination.name",
      "reviewers",
      "destination.customprop_asset_id",
      "destination.customprop_bu",
      "destination.customprop_display_name",
      "waypoint.name"
    ]
  }
}

The default sort value is source.type asc, and can be configured using an API.

Example sort setting:

{"value":{"order_by":"source.name desc"}}'

Reviewer interface preferences are saved to the browser. If a user has already customized columns, changes to the default settings won't apply.

Customize reminder and notification emails

Emails sent by Veza can include instructions, unique branding, and placeholders for metadata specific to the review. See Notification Templates to customize notification emails sent to reviewers and other stakeholders.

A template can be set for each potential usage (review created, row assigned, due date reminders, and others).
Placeholders can be used to include direct links to the review, dates, and reviewer metadata such as Name, depending on the selected usage.
Custom HTML/CSS can be included in a base64-encoded body template.
Templates can include links to images hosted externally or you can upload small files to Veza.
In addition to emails, administrators can add customized instructions that will be shown in a splash page when opening the reviewer interface. See Help Page Templates for more information.

See Notification Templates API for preview API usage details.

Review interface presentation rules

To enable easier identification of potentially dangerous results, Veza supports custom styling rules to highlight disabled (inactive) users. In addition to these rows appearing in red during review, the text summary shown when hovering the row will indicate that the user is inactive.

Please contact your Veza customer success team to enable this option. To highlight results based on a custom presentation rule, provide:

The filter string to use (for example source.is_active eq false). The property to match can be on the source or destination entity types in the configured query.
(Optional) a list of review ids the presentation rule will apply to (affecting all reviews on that configuration). Otherwise, rules apply to all reviews.

Saved filters

Administrators can add preset filters for users to choose from. Quick filters can be accessed under the Filters menu in the reviewer interface. When creating a saved filter, you can enable it for all reviews or just one.

See Quick Filters for more information about adding pre-built filters.

PreviousAccess Reviews Query Builder NextConfiguring a Global Identity Provider

Last updated 2 months ago