The component that filters the requestable applications under " Request New Access " in Saviynt is the Access Query . Here ' s a detailed explanation:

Saviynt ' s Access Request System (ARS): As the front end for requesting access, the ARS needs a mechanism to determine which applications (and entitlements) should be displayed to a user as requestable.

Access Query: This is a powerful feature within Saviynt that allows administrators to define specific criteria to control the visibility of applications and entitlements in the ARS. Think of it as a filter that determines what a user can see and request.

How Access Queries Work:

Defined on Applications/Entitlements: Access Queries are configured on individual applications or entitlements within Saviynt.

Based on User Attributes: They use user attributes (e.g., department, location, job title, group memberships) and other criteria (e.g., risk level) to determine if a user should see a particular application or entitlement.

Dynamic Filtering: When a user accesses the " Request New Access " section, Saviynt evaluates the Access Queries associated with each application and entitlement in real-time. Based on the user ' s attributes, the system dynamically filters the list, showing only the applications and entitlements that match the query conditions.

Saviynt ' s Security Model: Access Queries are a fundamental part of Saviynt ' s security model. They ensure that users are only presented with access options that are relevant and appropriate for their role and context, preventing accidental over-provisioning and reducing the attack surface.

Other Options:

Access Add Workflow: While essential for processing access requests, the workflow itself doesn ' t filter which applications are initially displayed.

Provisioning Connection: This relates to how Saviynt connects to target systems for automated provisioning. It doesn ' t control the initial visibility of applications in the ARS.

Whom to Request: This setting might determine the available approvers, but it doesn ' t filter the list of requestable applications.

In essence: Access Queries act as a dynamic filter, leveraging user attributes and defined criteria to determine which applications and entitlements are presented to a user within Saviynt ' s " Request New Access " interface, ensuring a personalized and secure access request experience.

=================

A Service Desk Connection in Saviynt is used to integrate with external ticketing systems. This integration allows Saviynt to:

Automate request fulfillment: Access requests created in Saviynt can automatically generate tickets in the service desk system.

Track request status: Saviynt can update the status of access requests based on the corresponding ticket status in the service desk system.

Improve communication: Integration facilitates seamless communication and collaboration between Saviynt and the service desk team.

Why other options are incorrect:

Service Ticket Connection, Ticket Connection, Provisioning Connection: These are not standard terms used in Saviynt for service desk integration.

Saviynt IGA References:

Saviynt Documentation: The documentation on integrating with Service Desk systems explains the purpose and configuration of a Service Desk Connection.

Saviynt Connectors: Saviynt provides connectors for popular service desk solutions like ServiceNow, facilitating the integration process.

When an " Add Access " task is successfully completed in Saviynt, the applicable status is typically " Provisioned. " Here ' s a detailed explanation with Saviynt references:

Saviynt ' s Task Management: Saviynt uses tasks to track the progress of various operations, including access provisioning. These tasks are generated as part of workflows, such as the " Access Add Workflow. "

" Add Access " Task Type: This specific task type is created when the access request is approved and the system is ready to grant the requested access to the target application.

Task Statuses in Saviynt: Saviynt uses different statuses to indicate the current state of a task. Common statuses include:

Pending: The task is waiting to be processed.

In Progress: The task is currently being executed.

Provisioned: This status signifies that the requested access has been successfully granted to the user in the target system.

Failed: The task encountered an error and could not be completed.

Manually Provisioned: The task was completed manually by an administrator, rather than through automated provisioning.

Success: While sometimes used, this status is less specific than " Provisioned " in the context of " Add Access " tasks, since it does not specify that the action completed was a provisioning action.

Active: Typically applies to accounts or users, not tasks.

Saviynt ' s Workflow Engine: The workflow engine in Saviynt updates the task status as it progresses through the defined steps. For connected applications, the workflow engine might directly interact with the target system ' s API to provision the access. Once the provisioning is successful, the status is updated to " Provisioned. "

Saviynt ' s Audit Trails: Saviynt maintains detailed audit trails, and the task status changes are logged. This provides a clear record of when access was provisioned for a user.

Other Options:

Success: As mentioned above, this is a general status. While technically correct (the task succeeded), " Provisioned " provides more context.

Manually Provisioned: This status is only applicable if an administrator intervened and manually granted the access outside of the automated workflow.

Active: This status typically pertains to a user or account ' s overall status, not specifically to the completion of an " Add Access " task.

=================

User Account Correlation Rules in Saviynt are specifically designed to map imported accounts to existing users within the system. These rules define the logic for matching accounts to users based on various attributes, such as employee ID, email address, or username.

Why other options are incorrect:

Account to User Rule: This is not a standard rule type in Saviynt.

Account Name Rule: This might focus on naming conventions for accounts, not correlating them to users.

Technical Rule: This is a broader category of rules and doesn ' t specifically address account-user mapping.

Saviynt IGA References:

Saviynt Documentation: The section on Account Correlation Rules provides detailed information on how to configure these rules for different scenarios.

Saviynt Use Cases: Saviynt often provides examples and use cases demonstrating how to use User Account Correlation Rules to automate account mapping during imports.

When Single Sign-On (SSO) is enabled in Saviynt EIC using an external Identity Provider (IdP) like Azure AD, it generally becomes the exclusive authentication method. This means users cannot use Saviynt ' s native authentication (i.e., logging in with a username/password stored directly within Saviynt).

Reasons for this:

Security and Centralized Control: SSO with an IdP enhances security by centralizing authentication and enforcing stronger password policies. Allowing native logins would create a potential bypass of these security measures.

User Experience: SSO provides a seamless login experience, eliminating the need for users to remember multiple credentials. Offering both SSO and native logins could lead to confusion and a less streamlined process.

Administrative Efficiency: SSO simplifies user management by delegating authentication to the IdP. Administrators don ' t need to manage separate user accounts and passwords within Saviynt.

Saviynt IGA References:

Saviynt Documentation: Saviynt ' s documentation on SSO configurations emphasizes that enabling SSO typically disables native authentication methods.

Saviynt Best Practices: Saviynt ' s best practices for SSO recommend enforcing SSO as the sole authentication method for improved security and user experience.

Saviynt Implementation Guides: Implementation guides for setting up SSO with various IdPs, including Azure AD, often highlight the exclusive nature of SSO authentication.

To view the Entitlements Query used in a previously launched Campaign in Saviynt, a Campaign Owner can use the C. Campaign Summary . Here ' s why:

Saviynt ' s Campaign Summary: The Campaign Summary provides a detailed overview of a campaign ' s configuration, including:

Campaign Scope: The users, applications, or entitlements included in the campaign.

Filters and Queries: Any filters or queries used to define the campaign scope, including the Entitlements Query.

Certifier Information: Details about the assigned certifiers.

Schedule: The campaign ' s start and end dates.

Status: The current status of the campaign (e.g., Active, Completed, Expired).

Accessing the Entitlements Query: The Campaign Summary typically includes a section that displays the exact query used to select the entitlements included in the campaign.

Why Other Options Are Less Suitable:

A. Reconfigure option: While you might be able to see the query by going into the reconfiguration, it ' s not the most direct way. The Campaign Summary is designed to provide this information readily.

B. Campaign Export: Exporting the campaign data might include the list of entitlements but not necessarily the original query used to select them.

D. Export option at the top right corner of the page, next to the Refresh Progress option: This option typically exports the current view of the campaign data, not the underlying configuration details like the Entitlements Query.

In conclusion: The Campaign Summary in Saviynt is the most direct and convenient place for a Campaign Owner to review the detailed configuration of a campaign, including the Entitlements Query used to define the campaign ' s scope.

=================

To configure a single report that displays the account attributes of all the accounts to their respective Application Owners in Saviynt, the best approach is D. V2 Analytics using SQL Query with User Context . Here ' s a breakdown:

Saviynt ' s Analytics V2: This is Saviynt ' s newer analytics platform, offering more advanced features and flexibility compared to the older version.

SQL Query with User Context: This is the key to achieving the desired outcome. " User Context " means that the query will be executed in the context of the currently logged-in user (in this case, the Application Owner).

How it Works:

Dynamic Filtering: When an Application Owner runs the report, the " User Context " will automatically filter the data to show only the accounts that they own.

Security and Data Privacy: This ensures that each Application Owner only sees the data that they are authorized to access.

SQL Query Structure: The SQL query would likely involve a JOIN between the accounts table and a table that defines application ownership (e.g., applications), using a WHERE clause that filters based on the current user ' s ID or username. Something like this (syntax might need adjustment for Saviynt ' s specific SQL dialect):

SELECT a.*

FROM accounts a

JOIN applications app ON a.application_id = app.application_id

WHERE app.owner_id = ${CURRENT_USER_ID} -- This is the user context part

Why Other Options Are Less Suitable:

A. Use Elasticsearch Query: While Elasticsearch can be used for analytics, it might not be the best tool for this specific requirement, as it doesn ' t inherently support the concept of " User Context " in the same way as SQL queries in Analytics V2.

B. V2 Analytics using SQL Query with External Connection: External connections are used to query data from external databases, which is not necessary in this scenario.

C. V2 Analytics using SQL Query with Allowed Action: Allowed Actions are used to define actions that can be performed on analytics results, not for filtering data based on user context.

The Job that should be created and scheduled to evaluate Rules on a need basis in Saviynt is A. Run Detective Rules and Take Action . Here ' s an explanation:

Saviynt ' s Jobs: Saviynt uses Jobs to perform various tasks, including data imports, rule evaluations, and provisioning operations.

" Run Detective Rules and Take Action " : This specific job is designed to:

Evaluate Rules: It evaluates rules that are configured for detective (monitoring) purposes. These rules typically check for specific conditions or changes in user attributes, access rights, or other data.

Take Action (Optional): Based on the rule evaluation results, the job can be configured to automatically take actions, such as:

Generating alerts or notifications.

Creating tasks for administrators to review.

Triggering workflows.

Automatically remediating issues (e.g., revoking access if a rule detects a violation).

Scheduling: This job can be scheduled to run periodically (e.g., daily, hourly) to continuously monitor for changes and enforce defined rules.

On-Demand Execution: You can also run this job on-demand to evaluate rules immediately.

Other Options:

B. Provisioning Job: This job is primarily used for provisioning access to target systems, not for evaluating general-purpose rules.

C. User Import via Connection: This job is for importing user data from external sources.

D. Trigger Chain Job: This allows for running a series or " chain " of jobs, but it doesn ' t directly evaluate rules itself.