Access Reviews Settings
Customizing Access review behavior for specific business needs and use cases.
Last updated
Was this helpful?
Customizing Access review behavior for specific business needs and use cases.
Last updated
Was this helpful?
Was this helpful?
Access Reviews settings can be customized to fit the needs of individual organizations and use cases, such as enabling auto-expiration, setting whether all rows need a decision before review completion, or requiring a note with certain decisions. You can also manage how Veza integrates with a corporate identity provider (IdP) to enable single sign-on and least-privilege review flows. See the following sections for more information:
Some of these options must be enabled by the Veza support team, while others can be configured using an API. See Access Review Settings for detailed API documentation.
When selecting reviewers for a new review or re-assigning row-level reviewers, you will choose, by default, from the list of Veza local users. This includes all local admin, operator, and reviewer root team users. External users from your identity provider are also shown, if they have already logged in with single sign-on and have an appropriate role.
By configuring a global identity provider, you can select reviewers from all users in your organization that Veza has discovered within an integrated IdP, including users who have never logged in to Veza. This eliminates the need to create user accounts for reviewers before they can be assigned to rows.
For example, if your organization's Okta domain is integrated with Veza and single sign-on (SSO) is enabled for your Veza tenant, all the domain's Okta Users will be suggested as possible reviewers. Those employees can then log in to Veza with SSO to complete their assigned reviews.
To enable a global Access Reviews Identity Provider, see Configuring a Global Identity Provider. Enabling a global identity provider also enables reviewer auto assignment to Entity Owners and Resource Manager Tags.
If notifications are enabled for a configuration or review, any new reviewers are notified by email, with a link to log in and make decisions on their assigned rows.
When using a global identity provider, it may be preferable for external users to have the Reviewer role assigned by default, preventing unauthorized access to other Veza functionality. You can change the default role under Sign-in Settings: Default Roles.
You can choose to auto-assign managers and resource owners when creating a review or re-assigning reviewers. Any rows in the review that cannot be auto-assigned are assigned to fallback reviewer(s).
To enable Veza to automatically identify managers and resource owners, see Entity Owners and Resource Manager Tags:
Within your IdP, set the corresponding manager property on the user object
Within Veza, add a Veza Tag that identifies a resource owner.
When an integrated Identity Provider (IdP) is configured as the global identity provider, these managers and resource owners can sign in to Veza without first needing to create an account.
You may want to prevent reviewers from being able to review and sign off on their own access in a review. When self-reivew prevention is enabled and a Global IdP is configured, users cannot be assigned to review rows for identities that match their global unique ID:
Users with an ID that correlates to a review row cannot be assigned as reviewers for that row: "[email protected]" cannot be assigned as a reviewer for any row in a review involving Okta User "[email protected]."
Users cannot be assigned to review access for local user accounts for which they're the top-level identity (if Veza has detected a correlation between an IdP User with id [email protected] and the local Snowflake User jsmith, IdP User [email protected] won't be allowed to be a reviewer for any rows that involve his local Snowflake User account jsmith.
Self-review prevention, as well as the deny list, applies when auto-assigning reviewers during review creation.
Self-review prevention can be enabled or disabled via API. Possible settings are:
SELF_REVIEWER_CHECKING_DISABLED (default)
SELF_REVIEWER_CHECKING_ENABLED
When auto-assigning reviewers, operators can specify a list of fallback reviewers. These users are assigned when self-review rules or the deny list would prevent the original assignment. They are also used when a manager or owner can’t be found.
If a fallback reviewer is prevented from reviewing their own access or is on the deny list, the other fallback reviewers are assigned to the row.
If there are no fallback reviewers and a rule prevents an assignment, Veza will select a reviewer in the following order:
The blocked user’s manager or resource owner (if not explicitly inactive)
The configuration creator
A Veza system administrator.
See Reviewer Selection Methods to customize this behavior.
Depending on how your organization conducts access reviews, you may prefer that users be able to complete reviews at any point, or want reviews to autocomplete when certain requirements are met.
By default, a review must be manually marked "complete" once a reviewer has signed off on all decisions. This setting can be changed so that reviews move are considered complete once a reviewer signs off on the final row. You can also customize autocomplete behavior to allow or prevent autocompletion of reviews that contain "Rejected" decisions.
This behavior is customizable using an API.
Example request:
{"value":"COMPLETION_ALLOWED_ALL_ROWS_HAVE_NON_REJECT_DECISION"}Possible values are
COMPLETION_ALLOWED_ALL_ROWS_HAVE_DECISION (default): Once all rows have a decision, the review will be automatically marked as complete and no further changes can be made.
COMPLETION_ALLOWED_ANYTIME Any reviewer can click Complete to finish and close the review at any point.
COMPLETION_ALLOWED_ALL_ROWS_HAVE_NON_REJECT_DECISION autocompletion occurs only when all rows were signed off as approved or were rejected but marked as “fixed.”
Auto Complete Settings determine whether reviews automatically move to "completed" status once the deadline is passed. Possible values are:
AUTO_COMPLETE_DISABLED (default)
AUTO_COMPLETE_ENABLED
Example request:
{"value":"AUTO_COMPLETE_ENABLED"}'}When enabled, all reviews will move to the EXPIRED status and become read-only once 24 hours have passed since the due date. Possible values are true or false (default). This behavior is customizable using an API.
By default, adding a note is optional when making decisions on rows. However, you may prefer that reviewers be required to leave a note under certain conditions. For example, you could require a note for rejected rows, while prompting (but not requiring) a note for approved rows.
Notes pop-up behavior sets whether the "Notes" modal appears and if a note is required when making decisions on rows. "Approve" and "Reject" behavior can be customized separately:
Approved notes behavior:
No pop-up (default)
Optional
Required
Rejected notes behavior:
No pop-up (default)
Optional
Required
This behavior is customizable using an API.
Example request:
{
"value": {
"accept_notes_behavior": "POP_UP_OPTIONAL",
"reject_notes_behavior": "POP_UP_REQUIRED"
}
}When "No pop up" is selected, no prompt is shown, and notes must be added by clicking Add Note. Otherwise, a note will be required or optional depending on the decision.
An administrator can customize row sort order and the default columns shown in reviewer interface. Columns can be customized globally and per configuration. New reviews will use the default columns for the parent configuration.
Administrators can also control column visibility based on user roles. The hide_from_reviewers_columns setting allows specific columns to be hidden from users with the reviewer role while remaining visible to administrators and operators. This is useful for hiding sensitive information like internal identifiers or technical details that should not be exposed to all reviewers.
See Customizing Default Columns for more information about the possible columns and API documentation.
The following example sets global default columns based on the source, destination node, and intermediate (waypoint) node properties, and shows each row's reviewers. It also hides sensitive columns from reviewers while keeping them visible to administrators:
{
"value": {
"default_ordered_columns": [
"source.customprop_worker_status",
"source.name",
"concrete_perms",
"destination.name",
"reviewers",
"destination.customprop_asset_id",
"destination.customprop_bu",
"destination.customprop_display_name",
"waypoint.name"
],
"hide_from_reviewers_columns": [
"source.identity_unique_id",
"idp.on_premises_distinguished_name"
]
}
}The default sort value is source.type asc, and can be configured using an API.
Example sort setting:
{"value":{"order_by":"source.name desc"}}'Administrators can configure how review rows are grouped to help reviewers process large datasets more efficiently. When enabled, rows are automatically organized by column values such as resource name, identity name, or review status, making it easier to review related items together.
Enabling this setting globally and for specific use cases can support faster review completion, help users identify patterns across similar items, and focus on single groups at a time for reduced cognitive load.
Row grouping can be configured Globally (establishing the default for all new reviews) or Per Review Configuration (overriding the global default for specific review types). Common options for grouping include:
By resource (destination.veza_unique_name): Review all access to each resource together
By identity (source.veza_unique_name): Review all of a user's access at once
By status (status): Focus on rows needing attention first
By risk level (risk_level): Prioritize high-risk access
For detailed API documentation and examples, see Review Row Grouping Settings.
Emails sent by Veza can include instructions, unique branding, and placeholders for metadata specific to the review. See Notification Templates to customize notification emails sent to reviewers and other stakeholders.
A template can be set for each potential usage (review created, row assigned, due date reminders, and others).
Placeholders can be used to include direct links to the review, dates, and reviewer metadata such as Name, depending on the selected usage.
Custom HTML/CSS can be included in a base64-encoded body template.
Templates can include links to images hosted externally or you can upload small files to Veza.
In addition to emails, administrators can add customized instructions that will be shown in a splash page when opening the reviewer interface. See Help Page Templates for more information.
See Notification Templates API for preview API usage details.
To enable easier identification of potentially dangerous results, Veza supports custom styling rules to highlight disabled (inactive) users. In addition to these rows appearing in red during review, the text summary shown when hovering the row will indicate that the user is inactive.
Please contact your Veza customer success team to enable this option. To highlight results based on a custom presentation rule, provide:
The filter string to use (for example source.is_active eq false). The property to match can be on the source or destination entity types in the configured query.
(Optional) a list of review ids the presentation rule will apply to (affecting all reviews on that configuration). Otherwise, rules apply to all reviews.
Organizations may need to control whether reviewers can export access review data based on security policies or compliance requirements. Veza provides granular control over export formats, allowing administrators to enable CSV exports while disabling PDF exports, or vice versa.
When export features are enabled, users with the reviewer role can download review data in the allowed formats for offline analysis and reporting, record-keeping, and integration with external tools and workflows.
When export features are disabled, the corresponding functionality is removed from the reviewer interface. This helps prevent unauthorized data exfiltration while allowing controlled exports.
By default, both CSV and PDF exports are disabled for enhanced security. Administrators must explicitly enable export capabilities as needed.
This behavior is customizable using an API. The setting can be configured globally for all reviews or for specific review configurations.
Example request to disable all exports (default):
{
"value": {
"allow_csv_exports": false,
"allow_pdf_exports": false
}
}Example request to enable only CSV exports for a specific review configuration:
{
"value": {
"allow_csv_exports": true,
"allow_pdf_exports": false
},
"workflow_id": "8ae1c414-3a76-46cb-950a-925316b3f264"
}Administrators can add preset filters for users to choose from. Quick filters can be accessed under the Filters menu in the reviewer interface. When creating a saved filter, you can enable it for all reviews or just one.
See Quick Filters for more information about adding pre-built filters.