Preview a modified provisioning policy

An administrator can preview the effect of a provisioning policy on users before adding, modifying, or deleting the policy. Previewing provides us with the number of affected accounts and details for each account the policy impacts. The provisioning policy preview provides details about the accounts that are:

If the results of the preview are what we expected, submit and activate the policy. If the results are not what we expected, revise the policy.

When we preview a modified policy, we can choose to have IBM Security Identity Manager compute the impact of the entire policy on all users that belong to policy memberships. Alternatively, we can choose to compute only the impact of the changes we made to the policy. For example, we modified an existing provisioning policy to include a newly defined role. We might want to preview the results of the modified policy selectively as they apply to users who were assigned to that role.

If a role is a member of another organizational role, the role member also inherits those permissions.

Accounts are evaluated based on that ownership type. Accounts with a different ownership type than the one specified in the changed entitlement are disallowed on that service. The exceptions are if we change the ownership type to All or the ownership type is covered by another entitlement on the same policy. In those cases, the accounts are not disallowed.

  1. From the navigation tree, select...

  2. Enter information about the provisioning policy in the Policy information field, or type an asterisk (*), and click Search.

  3. In the Provisioning Policies table, locate and select a provisioning policy, and click Change.

  4. On the Manage Provisioning Policies page, modify the information about the General, Members, and Entitlements pages, and click Preview.

  5. On the Preview Policy Enforcement page, select Enforce changes only or Enforce entire policy.

  6. Click Continue.

      The preview is generated and displayed on the Preview Policy Summary page, which is categorized by the following states:

      • Disallowed accounts
      • Noncompliant accounts
      • Compliant accounts

      Click a category of account changes to view the individual accounts the policy changes affect.

    • On the Preview Policy Summary page, click Close.

After determining that the effects of the policy changes are acceptable, the changes can be submitted to the system.

Parent topic: Provisioning policies