FIM Portal Management Policy Rules
Resource Type: ManagementPolicyRule
  1. DEEWR-ESS OSC or SEC users can read all DEEWR-roleTemplates
  2. Administration - Schema: Administrators can change selected attributes of non-system attribute type description resources
  3. Administration - Schema: Administrators can change selected attributes of non-system binding description resources
  4. Administration - Schema: Administrators can change selected attributes of non-system schema related resources
  5. Administration - Schema: Administrators can change selected attributes of schema related resources
  6. Administration - Schema: Administrators can create attribute type description resources
  7. Administration - Schema: Administrators can create binding description resources
  8. Administration - Schema: Administrators can create resource type description resources
  9. Administration - Schema: Administrators can delete non-system schema related resources
  10. Administration: Administrators can control requests
  11. Administration: Administrators can control synchronization configuration resources
  12. Administration: Administrators can delete non-administrator users
  13. Administration: Administrators can read all resources
  14. Administration: Administrators can read and update Users
  15. Administration: Administrators can update synchronization filter resources
  16. Administration: Administrators control configuration related resources
  17. Administration: Administrators control management policy rule resources
  18. Administration: Administrators control set resources
  19. Administration: Administrators control synchronization rule resources
  20. Administration: Administrators control workflow definition resources
  21. Administrators have full control over filter scope resources
  22. Button viewable management: Members could read all attributes of the sets in all button viewable sets
  23. DEEWR - All user changes are logged
  24. DEEWR: Administrators have full control over Activity Information Configuration resources
  25. DEEWR-Accepted invitations are applied to user entitlements
  26. DEEWR-Administration: Administrators can control DEEWR-esg-contracts
  27. DEEWR-Administration: Administrators can control DEEWR-esg-invitations
  28. DEEWR-Administration: Administrators can control DEEWR-esg-orgs
  29. DEEWR-Administration: Administrators can control DEEWR-esg-roles
  30. DEEWR-Administration: Administrators can control DEEWR-esg-roleTemplates
  31. DEEWR-Administration: Administrators can control DEEWR-esg-sites
  32. DEEWR-Administration: Administrators can control DEEWR-esg-userRoles
  33. DEEWR-Administration: Administrators can control DEEWR-subKeys
  34. DEEWR-Administration: Administrators can control DEEWR-vasco-DPTokens
  35. DEEWR-Administration: Administrators can create and update DEEWR-roles
  36. DEEWR-Administration: Administrators can read and update Claims
  37. DEEWR-Administration: Administrators can read and update DEEWR-claimType resources
  38. DEEWR-Administration: Administrators can read and update DEEWR-esg-generalRoles
  39. DEEWR-Administration: Administrators can read and update DEEWR-esg-reportingRoles
  40. DEEWR-Administration: Administrators can read and update Depts
  41. DEEWR-Administration: Administrators can read and update Users
  42. DEEWR-Administration: ESS Admins can read all DEEWR-claimType resources
  43. DEEWR-Administration: ESS Admins can read DEEWR-Apps
  44. DEEWR-Administration: ESS Admins can read DEEWR-claim resources
  45. DEEWR-Administration: ESS Admins can read DEEWR-roles
  46. DEEWR-Administration: ESS or SEC or SD3 or SD1 or EPS or OSC or SSC users can read DEEWR-vascoDPToken
  47. DEEWR-Administration: ESS SD3 and OSC users can control DEEWR-esg-invitations
  48. DEEWR-Administration: ESS SD3 users can create users
  49. DEEWR-Administration: ESS SEC or OSC or SSC users can read selected attibutes of their own
  50. DEEWR-Administration: ESS SEC or SD3 or SD1 or EPS or ACM or OSC or SSC users can read selected attibutes of other users
  51. DEEWR-Administration: ESS SEC or SD3 or SD1 or EPS or ACM or OSC or SSC users can update selected attibutes of other users
  52. DEEWR-Administration: ESS SEC or SD3 users can delete other users
  53. DEEWR-Administration: ESS SEC or SD3 users can read selected attibutes of other users
  54. DEEWR-Administration: ESS SEC or SD3 users can read DEEWR-esg-orgs
  55. DEEWR-Administration: ESS SEC or SD3 users can read DEEWR-esg-sites
  56. DEEWR-Administration: ESS SEC or SD3 users can update selected attibutes of other users
  57. DEEWR-Administration: Org OSCs can read and update Claims
  58. DEEWR-Administration: Site SSCs can read and update Claims
  59. DEEWR-Administration: Users can read all DEEWR-esg-userRoles
  60. DEEWR-Administration: Users can read DEEWR-esg-contracts
  61. DEEWR-Administration: Users can read DEEWR-esg-orgs
  62. DEEWR-Administration: Users can read DEEWR-esg-roles
  63. DEEWR-Administration: Users can read DEEWR-esg-sites
  64. DEEWR-Administration: Users can read DEEWR-subKeys
  65. DEEWR-Administration:ESS SEC or OSC or SSC users can update selected attibutes of their own
  66. DEEWR-Administration:Org OSCs can create users
  67. DEEWR-Administration:Site SSCs can create users
  68. DEEWR-All claims with missing references are deleted
  69. DEEWR-All claims with no claim values are deleted
  70. DEEWR-All empty user role assignments are removed
  71. DEEWR-Claims are updated with referenced display names
  72. DEEWR-Claims for ADMIN ROLES are created or updated for a user
  73. DEEWR-Claims for ADMIN ROLES are removed for a user
  74. DEEWR-Claims for ORGS are created or updated for a user
  75. DEEWR-Claims for ORGS are removed for a user
  76. DEEWR-Claims for ROLES are created or updated for a user
  77. DEEWR-Claims for ROLES are removed for a user
  78. DEEWR-Claims for SITES are created or updated for a user
  79. DEEWR-Claims for SITES are removed for a user
  80. DEEWR-Claims which are invalid for a given ORG and APPLICATION are deleted for a user
  81. DEEWR-Derive display name and description for user role assignments
  82. DEEWR-ESS Admins can create and update nominated DEEWR-esg-userRole attributes
  83. DEEWR-FIM workflow changes to users trigger Event Broker
  84. DEEWR-Initial password is cleared after user is first provisioned to AD
  85. DEEWR-Invalid esg roles for sites are removed
  86. DEEWR-Invalid esg sites and roles for org are removed
  87. DEEWR-Invitations where invitee cannot be resolved are deleted
  88. DEEWR-Invitees are resolved for new invitations
  89. DEEWR-Notify new invitations
  90. DEEWR-Org OSCs can administer users from their own Orgs
  91. DEEWR-Org users are updated with the matching OSC IDs
  92. DEEWR-Outbound policy for Claims to SQL
  93. DEEWR-Outbound Policy for Users to AD
  94. DEEWR-Password administrators reset passwords on behalf of others
  95. DEEWR-Rejected invitations are deleted
  96. DEEWR-SECs can createGlobal DEEWR-Templates
  97. DEEWR-SECs can delete Global DEEWR-Templates
  98. DEEWR-SECs can read Global DEEWR-Templates
  99. DEEWR-SECs can update Global DEEWR-Templates
  100. DEEWR-Site SSCs can administer users from their own Sites
  101. DEEWR-Site users are updated with the matching SSC IDs
  102. DEEWR-Synchronisation: Synchronisation Engine can control DEEWR-esg-contracts
  103. DEEWR-Synchronisation: Synchronisation Engine can control DEEWR-esg-orgs
  104. DEEWR-Synchronisation: Synchronisation Engine can control DEEWR-esg-roles
  105. DEEWR-Synchronisation: Synchronisation Engine can control DEEWR-esg-roleTemplates
  106. DEEWR-Synchronisation: Synchronisation Engine can control DEEWR-esg-sites
  107. DEEWR-Synchronisation: Synchronisation Engine can control DEEWR-vasco-DPTokens
  108. DEEWR-Synchronisation: Synchronisation Engine can read and update Applications
  109. DEEWR-Synchronisation: Synchronisation Engine can read and update Claims
  110. DEEWR-Synchronisation: Synchronisation Engine can read and update claimTypes
  111. DEEWR-Synchronisation: Synchronisation Engine can read and update DEEWR-esg-generalRoles
  112. DEEWR-Synchronisation: Synchronisation Engine can read and update DEEWR-esg-reportingRoles
  113. DEEWR-Synchronization: Synchronization account controls users it synchronizes
  114. DEEWR-Synchronization: Synchronization engine can read and update DEEWR-roles
  115. DEEWR-User Management: Developers can read and update DEEWR-esg-roles
  116. DEEWR-User management: ESS EMS Users can update selected attributes of their own
  117. DEEWR-User management: Users can read attributes of their own
  118. DEEWR-User management: Users can read DEEWR-esg-invitations
  119. DEEWR-User management: Users can read selected attributes of other users
  120. DEEWR-User management: Users can update selected attributes of DEEWR-esg-invitations
  121. DEEWR-User management: Users can update selected attributes of their own
  122. DEEWR-User reset password rule is removed after reset
  123. DEEWR-User roles are synchronised with non-OSC and SSC role assignments
  124. DEEWR-Users are updated with a new OSC
  125. DEEWR-Users are updated with a new SSC
  126. DEEWR-Users are updated with a removed OSC
  127. DEEWR-Users are updated with a removed SSC
  128. DEEWR-Users reset their own passwords
  129. Distribution list management: Owners can read attributes of group resources
  130. Distribution list management: Owners can update and delete groups they own
  131. Distribution list Management: Users can add or remove any members of groups subject to owner approval
  132. Distribution list management: Users can add or remove any members of groups that don't require owner approval
  133. Distribution List management: Users can create Static Distribution Groups
  134. Distribution list management: Users can read selected attributes of group resources
  135. General workflow: Filter attribute validation for administrator
  136. General workflow: Filter attribute validation for non-administrators
  137. General workflow: Registration initiation for authentication activity
  138. General: Users can read non-administrative configuration resources
  139. General: Users can read schema related resources
  140. Group management workflow: Group information validation for dynamic groups
  141. Group management workflow: Group information validation for static groups
  142. Group management workflow: Owner approval on add member
  143. Group management workflow: Validate requestor on add member to open group
  144. Group management workflow: Validate requestor on remove member
  145. Group management: Group administrators can create and delete group resources
  146. Group management: Group administrators can read attributes of group resources
  147. Group management: Group administrators can update group resources
  148. Request management: Request approvers can read their approval resources
  149. Request management: Request approvers can read their approval response resources
  150. Request management: Request creators can cancel their requests
  151. Request management: Request creators can read related approval response resources
  152. Request management: Request creators can read their approval resources
  153. Request management: Request creators can read their request resource
  154. Request management: Request participants can read related approval resources
  155. Request management: Request participants can read related approval response resources
  156. Request management: Request participants can read their request resource
  157. Security group management: Owners can read selected attributes of group resources
  158. Security group management: Owners can update and delete groups they own
  159. Security group management: Users can add or remove any member of groups subject to owner approval
  160. Security Group management: Users can create Static Security Groups
  161. Security group management: Users can read selected attributes of group resources
  162. Security groups: Users can add and remove members to open groups
  163. Synchronization: Synchronization account can delete and update expected rule entry resources
  164. Synchronization: Synchronization account can read group resources it synchronizes
  165. Synchronization: Synchronization account can read schema related resources
  166. Synchronization: Synchronization account can read synchronization related resources
  167. Synchronization: Synchronization account can read users it synchronizes
  168. Synchronization: Synchronization account controls detected rule entry resources
  169. Synchronization: Synchronization account controls group resources it synchronizes
  170. Synchronization: Synchronization account controls synchronization configuration resources
  171. Synchronization: Synchronization account controls users it synchronizes
  172. Temporal policy workflow: Impending group resource expiry notification
  173. User management: Users can read attributes of their own
  174. User management: Users can read selected attributes of other users
  175. User management: Users can update attributes of their own
  176. Users Management: Developers can read and update DEEWR-apps
  177. Users Management: Developers can read and update DEEWR-claimTypes
  178. Users Management: Developers can read and update DEEWR-esg-contracts
  179. Users Management: Developers can read and update DEEWR-esg-orgs
  180. Users Management: Developers can read and update DEEWR-esg-sites
Resource Type: Set
  1. Administrators
  2. All Active People
  3. All Activity Information Configurations
  4. All Approval Responses
  5. All Approvals
  6. All Attribute Definitions
  7. All Basic Configuration Objects
  8. All Bindings
  9. All Button Viewable Sets
  10. All Configuration Resources
  11. All DEEWR Claim administrators
  12. All DEEWR claim administrators and FIM services
  13. All DEEWR Claims
  14. All DEEWR Claims with invalid values
  15. All DEEWR Developers
  16. All DEEWR Domain users for provisioning
  17. All DEEWR ESS Admins
  18. All DEEWR ESS EMS users
  19. All DEEWR ESS OSC or SEC users
  20. All DEEWR ESS OSCs
  21. All DEEWR ESS SD3 and OSC users
  22. All DEEWR ESS SD3 users
  23. All DEEWR ESS SEC and SD3 users
  24. ALL DEEWR ESS SEC or OSC or SSC users
  25. All DEEWR ESS SEC users
  26. All DEEWR ESS SEC, SD3, SD1, EPS, OSC, ACM and SSC users
  27. All DEEWR ESS SSCs
  28. All DEEWR invalid claims to be deleted
  29. All DEEWR Org Claims
  30. All DEEWR OSC Org Assignments
  31. All DEEWR Password admins
  32. All DEEWR Site Claims
  33. All DEEWR SSC Site Assignments
  34. All DEEWR sub keys
  35. All DEEWR user role assignments which exclude OSC and SSC
  36. All DEEWR Users
  37. All DEEWR users with passwords being reset
  38. All DEEWR Users with reset password DREs
  39. ALL DEEWR Users with valid ADMIN ROLE claims
  40. All DEEWR users WITH valid ADMIN ROLEs
  41. ALL DEEWR Users with valid ORG claims
  42. ALL DEEWR Users with valid ROLE claims
  43. All DEEWR Users with valid SITE claims
  44. All DEEWR users WITHOUT valid ADMIN ROLEs
  45. All DEEWR-apps
  46. All DEEWR-claimTypes
  47. All DEEWR-dept
  48. All DEEWR-esg-claims with valid references
  49. All DEEWR-esg-contracts
  50. All DEEWR-esg-Global Role Templates
  51. All DEEWR-esg-invitations
  52. All DEEWR-esg-invitations accepted
  53. All DEEWR-esg-orgs
  54. All DEEWR-esg-roles
  55. All DEEWR-esg-roleTemplates
  56. All DEEWR-esg-sites
  57. All DEEWR-esg-userRoles
  58. All DEEWR-roles
  59. All DEEWR-vasco-DPTokens
  60. All Detected Rule Resources
  61. All Distribution Groups
  62. All Dynamic Groups
  63. All empty DEEWR user role assignments
  64. All expected rule resources
  65. All FilterScope Resources
  66. All Groups
  67. All Groups and Sets
  68. All ma-data and mv-data Resources
  69. All Management Policy Rules
  70. All Non-Administrators
  71. All Non-System Attribute Definitions
  72. All Non-System Binding Descriptions
  73. All Non-System Schema Objects
  74. All Object Type Definitions
  75. All Objects
  76. All People
  77. All Requests
  78. All Schema Objects
  79. All Security Groups
  80. All Sets
  81. All Static Groups
  82. All Synchronization Filter Definition Resources
  83. All Synchronization Related Resources
  84. All Synchronization Rule Resources
  85. All Workflows
  86. DEEWR-All invitations that failed to resolve
  87. DEEWR-All rejected invitations
  88. DEEWR-All unresolved invitations
  89. DEEWR-All valid claims
  90. DEEWR-Forefront Identity Manager Service Account
  91. DEEWR-Invitations with resolved invitees
  92. Expiring Group Resources
  93. Group Administrators
  94. Open Distribution Groups
  95. Open Groups
  96. Open Security Groups
  97. Owner Approved Distribution Groups
  98. Owner Approved Groups
  99. Owner Approved Security Groups
  100. Requests To Be Canceled
  101. Security Group Users
  102. Static Distribution Groups
  103. Static Security Groups
  104. Synchronization Engine
Resource Type: WorkflowDefinition
  1. DEEWR - Event Broker Data Changes
  2. DEEWR-Add org admins for an OSC
  3. DEEWR-Add site admins for an SSC
  4. DEEWR-Apply invitation to entitlements
  5. DEEWR-Clean up after user account is provisioned
  6. DEEWR-Clean up after user account password is reset
  7. DEEWR-Create or update user ADMIN ROLE claims
  8. DEEWR-Create or update user ESG ORG claims
  9. DEEWR-Create or update user ESG ROLE claims
  10. DEEWR-Create or update user ESG SITE claims
  11. DEEWR-Delete invalid user claims for Org and Application
  12. DEEWR-Delete invitation where invitee not resolved
  13. DEEWR-Delete Object by ID
  14. DEEWR-Delete rejected invitation
  15. DEEWR-Delete user ADMIN ROLE claims
  16. DEEWR-Delete user ESG ORG claims
  17. DEEWR-Delete user ESG ROLE claims
  18. DEEWR-Delete user ESG SITE claims
  19. DEEWR-Notify invitee resolved OK
  20. DEEWR-Outbound workflow for Claims to SQL
  21. DEEWR-Outbound Workflow for Users to AD
  22. DEEWR-Remove invalid esg roles for user sites
  23. DEEWR-Remove invalid esg sites and roles for user orgs
  24. DEEWR-Remove org admins for an OSC
  25. DEEWR-Remove site admins for an SSC
  26. DEEWR-Remove user role assignment by ID
  27. DEEWR-Reset user account password
  28. DEEWR-Resolve org invitee
  29. DEEWR-Set claim sync values
  30. DEEWR-Set derived DisplayName and Description for DEEWR-esg-userRole records
  31. DEEWR-Set OSCs for a user
  32. DEEWR-Set SSCs for a user
  33. DEEWR-Sync user roles
  34. Filter Validation Workflow for Administrators
  35. Filter Validation Workflow for Non-Administrators
  36. Group Expiration Notification Workflow
  37. Group Validation Workflow
  38. Owner Approval Workflow
  39. Requestor Validation With Owner Authorization
  40. Requestor Validation Without Owner Authorization
  41. System Workflow Required for Registration
1. DEEWR-ESS OSC or SEC users can read all DEEWR-roleTemplates ^Top
Management Policy Rule Configuration
Name DEEWR-ESS OSC or SEC users can read all DEEWR-roleTemplates
Description DEEWR-ESS OSC or SEC users can read all DEEWR-roleTemplates
Created Time 9/06/2011
Type Request
Grants Permissions True
Disabled False
Requestors and Operators
Requestor All DEEWR ESS OSC or SEC users
Operation Read
Target Resources
Before Request All DEEWR-esg-roleTemplates
After Request (Attribute)
Resources Attributes All Attributes
2. Administration - Schema: Administrators can change selected attributes of non-system attribute type description resources ^Top
Management Policy Rule Configuration
Name Administration - Schema: Administrators can change selected attributes of non-system attribute type description resources
Description Administration - Schema: Administrators can change selected attributes of non-system attribute type description resources
Created Time 25/10/2010
Type Request
Grants Permissions True
Disabled False
Requestors and Operators
Requestor Administrators
Operation Modify
Target Resources
Before Request All Non-System Attribute Definitions
After Request All Non-System Attribute Definitions
Resources Attributes IntegerMaximum, IntegerMinimum, Localizable, StringRegex
3. Administration - Schema: Administrators can change selected attributes of non-system binding description resources ^Top
Management Policy Rule Configuration
Name Administration - Schema: Administrators can change selected attributes of non-system binding description resources
Description Administration - Schema: Administrators can change selected attributes of non-system binding description resources
Created Time 25/10/2010
Type Request
Grants Permissions True
Disabled False
Requestors and Operators
Requestor Administrators
Operation Modify
Target Resources
Before Request All Non-System Binding Descriptions
After Request All Non-System Binding Descriptions
Resources Attributes IntegerMaximum, IntegerMinimum, Localizable, Required, StringRegex
4. Administration - Schema: Administrators can change selected attributes of non-system schema related resources ^Top
Management Policy Rule Configuration
Name Administration - Schema: Administrators can change selected attributes of non-system schema related resources
Description Administration - Schema: Administrators can change selected attributes of non-system schema related resources
Created Time 25/10/2010
Type Request
Grants Permissions True
Disabled False
Requestors and Operators
Requestor Administrators
Operation Modify
Target Resources
Before Request All Non-System Schema Objects
After Request All Non-System Schema Objects
Resources Attributes Description, DisplayName, IntegerMaximum, IntegerMinimum, Localizable, Required, StringRegex
5. Administration - Schema: Administrators can change selected attributes of schema related resources ^Top
Management Policy Rule Configuration
Name Administration - Schema: Administrators can change selected attributes of schema related resources
Description Administration - Schema: Administrators can change selected attributes of schema related resources
Created Time 25/10/2010
Type Request
Grants Permissions True
Disabled False
Requestors and Operators
Requestor Administrators
Operation Modify
Target Resources
Before Request All Schema Objects
After Request All Schema Objects
Resources Attributes Description, DisplayName
6. Administration - Schema: Administrators can create attribute type description resources ^Top
Management Policy Rule Configuration
Name Administration - Schema: Administrators can create attribute type description resources
Description Administration - Schema: Administrators can create attribute type description resources
Created Time 25/10/2010
Type Request
Grants Permissions True
Disabled False
Requestors and Operators
Requestor Administrators
Operation Create
Target Resources
Before Request (Attribute)
After Request All Attribute Definitions
Resources Attributes Description, DisplayName, DataType, IntegerMaximum, IntegerMinimum, Localizable, Multivalued, Name, ObjectType, StringRegex
7. Administration - Schema: Administrators can create binding description resources ^Top
Management Policy Rule Configuration
Name Administration - Schema: Administrators can create binding description resources
Description Administration - Schema: Administrators can create binding description resources
Created Time 25/10/2010
Type Request
Grants Permissions True
Disabled False
Requestors and Operators
Requestor Administrators
Operation Create
Target Resources
Before Request (Attribute)
After Request All Bindings
Resources Attributes Description, DisplayName, BoundAttributeType, BoundObjectType, IntegerMaximum, IntegerMinimum, Localizable, ObjectType, Required, StringRegex
8. Administration - Schema: Administrators can create resource type description resources ^Top
Management Policy Rule Configuration
Name Administration - Schema: Administrators can create resource type description resources
Description Administration - Schema: Administrators can create resource type description resources
Created Time 25/10/2010
Type Request
Grants Permissions True
Disabled False
Requestors and Operators
Requestor Administrators
Operation Create
Target Resources
Before Request (Attribute)
After Request All Object Type Definitions
Resources Attributes Description, DisplayName, Name, ObjectType
9. Administration - Schema: Administrators can delete non-system schema related resources ^Top
Management Policy Rule Configuration
Name Administration - Schema: Administrators can delete non-system schema related resources
Description Administration - Schema: Administrators can delete non-system schema related resources
Created Time 25/10/2010
Type Request
Grants Permissions True
Disabled False
Requestors and Operators
Requestor Administrators
Operation Delete
Target Resources
Before Request All Non-System Schema Objects
After Request (Attribute)
Resources Attributes All Attributes
10. Administration: Administrators can control requests ^Top
Management Policy Rule Configuration
Name Administration: Administrators can control requests
Description Administration: Administrators can control requests
Created Time 25/10/2010
Type Request
Grants Permissions True
Disabled False
Requestors and Operators
Requestor Administrators
Operation Modify
Target Resources
Before Request All Requests
After Request All Requests
Resources Attributes RequestControl
11. Administration: Administrators can control synchronization configuration resources ^Top
Management Policy Rule Configuration
Name Administration: Administrators can control synchronization configuration resources
Description Administration: Administrators can control synchronization configuration resources
Created Time 25/10/2010
Type Request
Grants Permissions True
Disabled False
Requestors and Operators
Requestor Administrators
Operation Create, Delete, Add, Modify, Remove
Target Resources
Before Request All ma-data and mv-data Resources
After Request All ma-data and mv-data Resources
Resources Attributes MVObjectID, Description, DisplayName, ExpirationTime, ObjectType, SyncConfig-category, SyncConfig-id, SyncConfig-sub-type, SyncConfig-ma-listname, SyncConfig-ma-companyname, SyncConfig-creation-time, SyncConfig-last-modification-time, SyncConfig-version, SyncConfig-format-version, SyncConfig-internal-version, SyncConfig-schema, SyncConfig-attribute-inclusion, SyncConfig-stay-disconnector, SyncConfig-join, SyncConfig-projection, SyncConfig-export-attribute-flow, SyncConfig-provisioning-cleanup, SyncConfig-provisioning-cleanup-type, SyncConfig-extension, SyncConfig-controller-configuration, SyncConfig-password-sync-allowed, SyncConfig-ma-ui-settings, SyncConfig-private-configuration, SyncConfig-encrypted-attributes, SyncConfig-ma-partition-data, SyncConfig-ma-run-data, SyncConfig-capabilities-mask, SyncConfig-export-type, SyncConfig-dn-construction, SyncConfig-password-sync, SyncConfig-component_mappings, SyncConfig-refresh-schema, SyncConfig-import-attribute-flow, SyncConfig-mv-deletion, SyncConfig-provisioning, SyncConfig-provisioning-type, SyncConfig-password-change-history-size
12. Administration: Administrators can delete non-administrator users ^Top
Management Policy Rule Configuration
Name Administration: Administrators can delete non-administrator users
Description Administration: Administrators can delete non-administrator users
Created Time 25/10/2010
Type Request
Grants Permissions True
Disabled False
Requestors and Operators
Requestor Administrators
Operation Delete
Target Resources
Before Request All Non-Administrators
After Request All Non-Administrators
Resources Attributes All Attributes
13. Administration: Administrators can read all resources ^Top
Management Policy Rule Configuration
Name Administration: Administrators can read all resources
Description Administration: Administrators can read all resources
Created Time 25/10/2010
Type Request
Grants Permissions True
Disabled False
Requestors and Operators
Requestor Administrators
Operation Read
Target Resources
Before Request All Objects
After Request All Objects
Resources Attributes All Attributes
14. Administration: Administrators can read and update Users ^Top
Management Policy Rule Configuration
Name Administration: Administrators can read and update Users
Description Administration: Administrators can read and update Users
Created Time 25/10/2010
Type Request
Grants Permissions True
Disabled False
Requestors and Operators
Requestor Administrators
Operation Create, Add, Modify, Remove, Read
Target Resources
Before Request All People
After Request All People
Resources Attributes Description, DisplayName, ExpirationTime, AccountName, AD_UserCannotChangePassword, Address, Assistant, AuthNWFRegistered, City, AuthNWFLockedOut, AuthNLockoutRegistrationID, Company, CostCenter, CostCenterName, Country, Department, Domain, DomainConfiguration, Email, EmployeeEndDate, EmployeeID, EmployeeStartDate, EmployeeType, FirstName, FreezeCount, FreezeLevel, IsRASEnabled, JobTitle, LastName, LastResetAttemptTime, LoginName, MailNickname, Manager, MiddleName, MobilePhone, ObjectType, ObjectSID, OfficeFax, OfficeLocation, OfficePhone, Register, ResetPassword, Photo, PostalCode, ProxyAddressCollection, RegistrationRequired, TimeZone, DEEWR-employmentAUExtIAMAdminRoles, DEEWR-employmentAUExtInquisitionStatus, DEEWR-employmentAUExtOrgCode, DEEWR-employmentAUExtSecurityRole1, DEEWR-employmentAUExtSecurityRole2, DEEWR-employmentAUExtSecurityRole4, DEEWR-employmentAUExtSite, DEEWR-employmentAUIntIMUserOrgDN
15. Administration: Administrators can update synchronization filter resources ^Top
Management Policy Rule Configuration
Name Administration: Administrators can update synchronization filter resources
Description Administration: Administrators can update synchronization filter resources
Created Time 25/10/2010
Type Request
Grants Permissions True
Disabled False
Requestors and Operators
Requestor Administrators
Operation Add, Modify, Remove
Target Resources
Before Request All Synchronization Filter Definition Resources
After Request All Synchronization Filter Definition Resources
Resources Attributes Description, DisplayName, SynchronizeObjectType
16. Administration: Administrators control configuration related resources ^Top
Management Policy Rule Configuration
Name Administration: Administrators control configuration related resources
Description Administration: Administrators control configuration related resources
Created Time 25/10/2010
Type Request
Grants Permissions True
Disabled False
Requestors and Operators
Requestor Administrators
Operation Create, Delete, Add, Modify, Remove
Target Resources
Before Request All Configuration Resources
After Request All Configuration Resources
Resources Attributes Description, DisplayName, ExpirationTime, ActivityName, AppliesToCreate, AppliesToEdit, AppliesToView, AssemblyName, BoundAttributeType, BoundObjectType, BrandingCenterText, BrandingLeftImage, BrandingRightImage, ConfigurationData, ConstantValueKey, ContactSet, CountXPath, DistributionListDomain, Domain, EmailBody, EmailSubject, EmailTemplateType, ForeignSecurityPrincipalSet, ForestConfiguration, ImageUrl, IsActionActivity, IsAuthenticationActivity, IsAuthoriztionActivity, IsConfigurationType, NavigationPage, NavigationUrl, ObjectType, Order, ParentOrder, Region, SearchScope, SearchScopeColumn, SearchScopeContext, SearchScopeResultObjectType, SearchScopeTargetURL, StringResources, SupportedLanguageCode, TargetObjectType, TimeZone, TimeZoneId, TrustedForest, TypeName, UICacheTime, UICountCacheTime, UIUserCacheTime, UsageKeyword, ListViewCacheTimeOut, ListViewPageSize, ListViewPagesToCache
17. Administration: Administrators control management policy rule resources ^Top
Management Policy Rule Configuration
Name Administration: Administrators control management policy rule resources
Description Administration: Administrators control management policy rule resources
Created Time 25/10/2010
Type Request
Grants Permissions True
Disabled False
Requestors and Operators
Requestor Administrators
Operation Create, Delete, Add, Modify, Remove
Target Resources
Before Request All Management Policy Rules
After Request All Management Policy Rules
Resources Attributes Description, DisplayName, ExpirationTime, ActionParameter, ActionWorkflowDefinition, ActionType, AuthenticationWorkflowDefinition, AuthorizationWorkflowDefinition, Disabled, GrantRight, ObjectType, PrincipalSet, PrincipalRelativeToResource, ResourceCurrentSet, ResourceFinalSet, ManagementPolicyRuleType
18. Administration: Administrators control set resources ^Top
Management Policy Rule Configuration
Name Administration: Administrators control set resources
Description Administration: Administrators control set resources
Created Time 25/10/2010
Type Request
Grants Permissions True
Disabled False
Requestors and Operators
Requestor Administrators
Operation Create, Delete, Add, Modify, Remove
Target Resources
Before Request All Sets
After Request All Sets
Resources Attributes Description, DisplayName, ExpirationTime, ExplicitMember, Filter, ObjectType, ResourceParent
19. Administration: Administrators control synchronization rule resources ^Top
Management Policy Rule Configuration
Name Administration: Administrators control synchronization rule resources
Description Administration: Administrators control synchronization rule resources
Created Time 25/10/2010
Type Request
Grants Permissions True
Disabled False
Requestors and Operators
Requestor Administrators
Operation Create, Delete, Add, Modify, Remove
Target Resources
Before Request All Synchronization Rule Resources
After Request All Synchronization Rule Resources
Resources Attributes Description, DisplayName, ExpirationTime, ConnectedObjectType, ConnectedSystem, ConnectedSystemScope, CreateConnectedSystemObject, CreateILMObject, DisconnectConnectedSystemObject, Dependency, ExistenceTest, FlowType, ILMObjectType, ILMScoping, InitialFlow, ObjectType, PersistentFlow, Precedence, RelationshipCriteria, SynchronizationRuleParameters, ManagementAgentID
20. Administration: Administrators control workflow definition resources ^Top
Management Policy Rule Configuration
Name Administration: Administrators control workflow definition resources
Description Administration: Administrators control workflow definition resources
Created Time 25/10/2010
Type Request
Grants Permissions True
Disabled False
Requestors and Operators
Requestor Administrators
Operation Create, Delete, Modify
Target Resources
Before Request All Workflows
After Request All Workflows
Resources Attributes Description, DisplayName, ClearRegistration, ObjectType, RequestPhase, RunOnPolicyUpdate, XOML, Rules
21. Administrators have full control over filter scope resources ^Top
Management Policy Rule Configuration
Name Administrators have full control over filter scope resources
Description Administrators have full control over filter scope resources
Created Time 25/10/2010
Type Request
Grants Permissions True
Disabled False
Requestors and Operators
Requestor Administrators
Operation Create, Delete, Add, Modify, Remove
Target Resources
Before Request All FilterScope Resources
After Request All FilterScope Resources
Resources Attributes Description, DisplayName, AllowedAttributes, AllowedMembershipReferences, ObjectType
22. Button viewable management: Members could read all attributes of the sets in all button viewable sets ^Top
Management Policy Rule Configuration
Name Button viewable management: Members could read all attributes of the sets in all button viewable sets
Description Button viewable management: Members could read all attributes of the sets in all button viewable sets
Created Time 25/10/2010
Type Request
Grants Permissions True
Disabled False
Requestors and Operators
Requestor ComputedMember (Attribute)
Operation Read
Target Resources
Before Request All Button Viewable Sets
After Request All Button Viewable Sets
Resources Attributes All Attributes
23. DEEWR - All user changes are logged ^Top
Management Policy Rule Configuration
Name DEEWR - All user changes are logged
Description FIM Auto Pilot configuration for Event Broker
Created Time 25/02/2011
Type Request
Grants Permissions False
Disabled False
Requestors and Operators
Requestor All People
Operation Add, Create, Delete, Modify, Remove
Target Resources
Before Request All People
After Request All People
Resources Attributes Description, DetectedRulesList, DisplayName, ExpectedRulesList, ObjectID, ResourceTime
Policy Workflows
Type Display Name
Action DEEWR - Event Broker Data Changes
24. DEEWR: Administrators have full control over Activity Information Configuration resources ^Top
Management Policy Rule Configuration
Name DEEWR: Administrators have full control over Activity Information Configuration resources
Description Administrators have full control over Activity Information Configuration resources (Not included in vanilla FIM install)
Created Time 25/02/2011
Type Request
Grants Permissions True
Disabled False
Requestors and Operators
Requestor Administrators
Operation Add, Create, Delete, Modify, Read, Remove
Target Resources
Before Request All Activity Information Configurations
After Request All Activity Information Configurations
Resources Attributes All Attributes
25. DEEWR-Accepted invitations are applied to user entitlements ^Top
Management Policy Rule Configuration
Name DEEWR-Accepted invitations are applied to user entitlements
Description
Created Time 16/05/2011
Type Request
Grants Permissions False
Disabled False
Requestors and Operators
Requestor All DEEWR ESS SD3 and OSC users
Operation Modify
Target Resources
Before Request All DEEWR-esg-invitations
After Request All DEEWR-esg-invitations accepted
Resources Attributes DEEWR-esg-isAccepted
Policy Workflows
Type Display Name
Action DEEWR-Apply invitation to entitlements
26. DEEWR-Administration: Administrators can control DEEWR-esg-contracts ^Top
Management Policy Rule Configuration
Name DEEWR-Administration: Administrators can control DEEWR-esg-contracts
Description DEEWR-Administration: Administrators can control DEEWR-esg-contracts
Created Time 23/02/2011
Type Request
Grants Permissions True
Disabled False
Requestors and Operators
Requestor Administrators
Operation Add, Create, Modify, Read, Remove, Delete
Target Resources
Before Request All DEEWR-esg-contracts
After Request All DEEWR-esg-contracts
Resources Attributes All Attributes
Policy Workflows
Type Display Name
Action DEEWR - Event Broker Data Changes
27. DEEWR-Administration: Administrators can control DEEWR-esg-invitations ^Top
Management Policy Rule Configuration
Name DEEWR-Administration: Administrators can control DEEWR-esg-invitations
Description Administrators can control DEEWR-esg-invitations
Created Time 13/05/2011
Type Request
Grants Permissions True
Disabled False
Requestors and Operators
Requestor Administrators
Operation Add, Create, Delete, Modify, Remove
Target Resources
Before Request All DEEWR-esg-invitations
After Request All DEEWR-esg-invitations
Resources Attributes All Attributes
28. DEEWR-Administration: Administrators can control DEEWR-esg-orgs ^Top
Management Policy Rule Configuration
Name DEEWR-Administration: Administrators can control DEEWR-esg-orgs
Description DEEWR-Administration: Administrators can control DEEWR-esg-orgs
Created Time 23/02/2011
Type Request
Grants Permissions True
Disabled False
Requestors and Operators
Requestor Administrators
Operation Add, Create, Modify, Read, Remove, Delete
Target Resources
Before Request All DEEWR-esg-orgs
After Request All DEEWR-esg-orgs
Resources Attributes All Attributes
Policy Workflows
Type Display Name
Action DEEWR - Event Broker Data Changes
29. DEEWR-Administration: Administrators can control DEEWR-esg-roles ^Top
Management Policy Rule Configuration
Name DEEWR-Administration: Administrators can control DEEWR-esg-roles
Description DEEWR-Administration: Administrators can control DEEWR-esg-roles
Created Time 11/04/2011
Type Request
Grants Permissions True
Disabled False
Requestors and Operators
Requestor Administrators
Operation Add, Create, Modify, Remove, Delete
Target Resources
Before Request All DEEWR-esg-roles
After Request All DEEWR-esg-roles
Resources Attributes All Attributes
Policy Workflows
Type Display Name
Action DEEWR - Event Broker Data Changes
30. DEEWR-Administration: Administrators can control DEEWR-esg-roleTemplates ^Top
Management Policy Rule Configuration
Name DEEWR-Administration: Administrators can control DEEWR-esg-roleTemplates
Description DEEWR-Administration: Administrators can control DEEWR-esg-roleTemplates
Created Time 5/05/2011
Type Request
Grants Permissions True
Disabled False
Requestors and Operators
Requestor Administrators
Operation Add, Create, Delete, Modify, Read, Remove
Target Resources
Before Request All DEEWR-esg-roleTemplates
After Request All DEEWR-esg-roleTemplates
Resources Attributes All Attributes
Policy Workflows
Type Display Name
Action DEEWR - Event Broker Data Changes
31. DEEWR-Administration: Administrators can control DEEWR-esg-sites ^Top
Management Policy Rule Configuration
Name DEEWR-Administration: Administrators can control DEEWR-esg-sites
Description DEEWR-Administration: Administrators can control DEEWR-esg-sites
Created Time 23/02/2011
Type Request
Grants Permissions True
Disabled False
Requestors and Operators
Requestor Administrators
Operation Add, Create, Modify, Read, Remove, Delete
Target Resources
Before Request All DEEWR-esg-sites
After Request All DEEWR-esg-sites
Resources Attributes All Attributes
Policy Workflows
Type Display Name
Action DEEWR - Event Broker Data Changes
32. DEEWR-Administration: Administrators can control DEEWR-esg-userRoles ^Top
Management Policy Rule Configuration
Name DEEWR-Administration: Administrators can control DEEWR-esg-userRoles
Description DEEWR-Administration: Administrators can control DEEWR-esg-userRoles
Created Time 30/05/2011
Type Request
Grants Permissions True
Disabled False
Requestors and Operators
Requestor Administrators
Operation Add, Create, Remove, Modify
Target Resources
Before Request All DEEWR-esg-userRoles
After Request All DEEWR-esg-userRoles
Resources Attributes DEEWR-assignedRoleID, DEEWR-esg-targetID, DEEWR-userID, Creator, ObjectID, ObjectType
33. DEEWR-Administration: Administrators can control DEEWR-subKeys ^Top
Management Policy Rule Configuration
Name DEEWR-Administration: Administrators can control DEEWR-subKeys
Description Administration: Administrators can control DEEWR-subKeys
Created Time 27/06/2011
Type Request
Grants Permissions True
Disabled False
Requestors and Operators
Requestor Administrators
Operation Create, Delete, Modify
Target Resources
Before Request All DEEWR sub keys
After Request All DEEWR sub keys
Resources Attributes All Attributes
34. DEEWR-Administration: Administrators can control DEEWR-vasco-DPTokens ^Top
Management Policy Rule Configuration
Name DEEWR-Administration: Administrators can control DEEWR-vasco-DPTokens
Description DEEWR-Administration: Administrators can control DEEWR-vasco-DPTokens
Created Time 23/05/2011
Type Request
Grants Permissions True
Disabled False
Requestors and Operators
Requestor Administrators
Operation Create, Delete, Modify, Read
Target Resources
Before Request All DEEWR-vasco-DPTokens
After Request All DEEWR-vasco-DPTokens
Resources Attributes DEEWR-vasco-DirectAssignOnly, DEEWR-vasco-SerialNumber, DEEWR-vasco-TokenType, Description, DisplayName
35. DEEWR-Administration: Administrators can create and update DEEWR-roles ^Top
Management Policy Rule Configuration
Name DEEWR-Administration: Administrators can create and update DEEWR-roles
Description DEEWR-Administration: Administrators can create and update DEEWR-roles
Created Time 11/05/2011
Type Request
Grants Permissions True
Disabled False
Requestors and Operators
Requestor Administrators
Operation Add, Create, Modify, Remove
Target Resources
Before Request All DEEWR-roles
After Request All DEEWR-roles
Resources Attributes All Attributes
36. DEEWR-Administration: Administrators can read and update Claims ^Top
Management Policy Rule Configuration
Name DEEWR-Administration: Administrators can read and update Claims
Description DEEWR-Administration: Administrators can read and update Claims
Created Time 9/03/2011
Type Request
Grants Permissions True
Disabled False
Requestors and Operators
Requestor Administrators
Operation Add, Create, Delete, Modify, Read, Remove
Target Resources
Before Request All DEEWR Claims
After Request All DEEWR Claims
Resources Attributes All Attributes
Policy Workflows
Type Display Name
Action DEEWR - Event Broker Data Changes
37. DEEWR-Administration: Administrators can read and update DEEWR-claimType resources ^Top
Management Policy Rule Configuration
Name DEEWR-Administration: Administrators can read and update DEEWR-claimType resources
Description Administrators can read and update DEEWR-claimType resources
Created Time 9/03/2011
Type Request
Grants Permissions True
Disabled False
Requestors and Operators
Requestor Administrators
Operation Add, Create, Delete, Modify, Read, Remove
Target Resources
Before Request All DEEWR-claimTypes
After Request All DEEWR-claimTypes
Resources Attributes All Attributes
38. DEEWR-Administration: Administrators can read and update DEEWR-esg-generalRoles ^Top
Management Policy Rule Configuration
Name DEEWR-Administration: Administrators can read and update DEEWR-esg-generalRoles
Description DEEWR-Administration: Administrators can read and update DEEWR-esg-generalRoles
Created Time 5/04/2011
Type Request
Grants Permissions True
Disabled False
Requestors and Operators
Requestor Administrators
Operation Add, Create, Modify, Read, Remove
Target Resources
Before Request (Attribute)
After Request (Attribute)
Resources Attributes All Attributes
39. DEEWR-Administration: Administrators can read and update DEEWR-esg-reportingRoles ^Top
Management Policy Rule Configuration
Name DEEWR-Administration: Administrators can read and update DEEWR-esg-reportingRoles
Description DEEWR-Administration: Administrators can read and update DEEWR-esg-reportingRoles
Created Time 5/04/2011
Type Request
Grants Permissions True
Disabled False
Requestors and Operators
Requestor Administrators
Operation Add, Create, Modify, Read, Remove
Target Resources
Before Request (Attribute)
After Request (Attribute)
Resources Attributes All Attributes
40. DEEWR-Administration: Administrators can read and update Depts ^Top
Management Policy Rule Configuration
Name DEEWR-Administration: Administrators can read and update Depts
Description DEEWR-Administration: Administrators can read and update Depts
Created Time 13/04/2011
Type Request
Grants Permissions True
Disabled False
Requestors and Operators
Requestor Administrators
Operation Add, Create, Modify, Read, Remove
Target Resources
Before Request All DEEWR-dept
After Request All DEEWR-dept
Resources Attributes All Attributes
41. DEEWR-Administration: Administrators can read and update Users ^Top
Management Policy Rule Configuration
Name DEEWR-Administration: Administrators can read and update Users
Description DEEWR Administrators can read and update Users
Created Time 17/05/2011
Type Request
Grants Permissions True
Disabled False
Requestors and Operators
Requestor Administrators
Operation Add, Create, Delete, Modify, Read, Remove
Target Resources
Before Request All DEEWR Users
After Request All DEEWR Users
Resources Attributes All Attributes
42. DEEWR-Administration: ESS Admins can read all DEEWR-claimType resources ^Top
Management Policy Rule Configuration
Name DEEWR-Administration: ESS Admins can read all DEEWR-claimType resources
Description ESS Admins can read all DEEWR-claimType resources
Created Time 12/07/2011
Type Request
Grants Permissions True
Disabled False
Requestors and Operators
Requestor All DEEWR ESS Admins
Operation Read
Target Resources
Before Request All DEEWR-claimTypes
After Request (Attribute)
Resources Attributes All Attributes
43. DEEWR-Administration: ESS Admins can read DEEWR-Apps ^Top
Management Policy Rule Configuration
Name DEEWR-Administration: ESS Admins can read DEEWR-Apps
Description ESS Admins can read DEEWR-Apps
Created Time 8/06/2011
Type Request
Grants Permissions True
Disabled False
Requestors and Operators
Requestor All DEEWR ESS Admins
Operation Read
Target Resources
Before Request All DEEWR-apps
After Request (Attribute)
Resources Attributes All Attributes
44. DEEWR-Administration: ESS Admins can read DEEWR-claim resources ^Top
Management Policy Rule Configuration
Name DEEWR-Administration: ESS Admins can read DEEWR-claim resources
Description ESS Admins can read DEEWR-claim resources
Created Time 12/07/2011
Type Request
Grants Permissions True
Disabled False
Requestors and Operators
Requestor All DEEWR ESS Admins
Operation Read
Target Resources
Before Request All DEEWR Claims
After Request (Attribute)
Resources Attributes All Attributes
45. DEEWR-Administration: ESS Admins can read DEEWR-roles ^Top
Management Policy Rule Configuration
Name DEEWR-Administration: ESS Admins can read DEEWR-roles
Description DEEWR-Administration: ESS Admins can read DEEWR-roles
Created Time 19/05/2011
Type Request
Grants Permissions True
Disabled False
Requestors and Operators
Requestor All DEEWR ESS Admins
Operation Read
Target Resources
Before Request All DEEWR-roles
After Request (Attribute)
Resources Attributes All Attributes
46. DEEWR-Administration: ESS or SEC or SD3 or SD1 or EPS or OSC or SSC users can read DEEWR-vascoDPToken ^Top
Management Policy Rule Configuration
Name DEEWR-Administration: ESS or SEC or SD3 or SD1 or EPS or OSC or SSC users can read DEEWR-vascoDPToken
Description DEEWR-Administration: ESS or SEC or SD3 or SD1 or EPS or OSC or SSC users can read DEEWR-vascoDPToken
Created Time 9/06/2011
Type Request
Grants Permissions True
Disabled False
Requestors and Operators
Requestor All DEEWR ESS SEC, SD3, SD1, EPS, OSC, ACM and SSC users
Operation Read
Target Resources
Before Request All DEEWR-vasco-DPTokens
After Request (Attribute)
Resources Attributes All Attributes
47. DEEWR-Administration: ESS SD3 and OSC users can control DEEWR-esg-invitations ^Top
Management Policy Rule Configuration
Name DEEWR-Administration: ESS SD3 and OSC users can control DEEWR-esg-invitations
Description DEEWR-Administration: ESS SD3 and OSC users can control DEEWR-esg-invitations
Created Time 8/06/2011
Type Request
Grants Permissions True
Disabled False
Requestors and Operators
Requestor All DEEWR ESS SD3 and OSC users
Operation Add, Create, Delete, Modify, Remove
Target Resources
Before Request All DEEWR-esg-invitations
After Request All DEEWR-esg-invitations
Resources Attributes All Attributes
48. DEEWR-Administration: ESS SD3 users can create users ^Top
Management Policy Rule Configuration
Name DEEWR-Administration: ESS SD3 users can create users
Description DEEWR-Administration: ESS SD3 users can create users
Created Time 9/06/2011
Type Request
Grants Permissions True
Disabled False
Requestors and Operators
Requestor All DEEWR ESS SD3 users
Operation Create
Target Resources
Before Request (Attribute)
After Request All DEEWR Users
Resources Attributes All Attributes
49. DEEWR-Administration: ESS SEC or OSC or SSC users can read selected attibutes of their own ^Top
Management Policy Rule Configuration
Name DEEWR-Administration: ESS SEC or OSC or SSC users can read selected attibutes of their own
Description DEEWR-Administration: ESS SEC or OSC or SSC users can read selected attibutes of their own
Created Time 10/06/2011
Type Request
Grants Permissions True
Disabled False
Requestors and Operators
Requestor ObjectID (Attribute)
Operation Read
Target Resources
Before Request All DEEWR Users
After Request (Attribute)
Resources Attributes DEEWR-esg-securityReports
50. DEEWR-Administration: ESS SEC or SD3 or SD1 or EPS or ACM or OSC or SSC users can read selected attibutes of other users ^Top
Management Policy Rule Configuration
Name DEEWR-Administration: ESS SEC or SD3 or SD1 or EPS or ACM or OSC or SSC users can read selected attibutes of other users
Description DEEWR-Administration: ESS SEC or SD3 or SD1 or EPS or ACM or OSC or SSC users can read selected attibutes of other users
Created Time 8/06/2011
Type Request
Grants Permissions True
Disabled True
Requestors and Operators
Requestor All DEEWR ESS SEC, SD3, SD1, EPS, OSC, ACM and SSC users
Operation Read
Target Resources
Before Request All DEEWR Users
After Request (Attribute)
Resources Attributes AccountName, DEEWR-esg-organisationID, DEEWR-esg-siteID, DEEWR-roleID, Email, FirstName, LastName, CreatedTime, DEEWR-codeWord, DEEWR-esg-contractID, DEEWR-esg-roleID, DEEWR-vasco-linkVascoUserToVascoDigipass, DisplayName, lastLogon, OfficePhone, whenCreated, DEEWR-userAccountControl, DEEWR-unicodePwd
51. DEEWR-Administration: ESS SEC or SD3 or SD1 or EPS or ACM or OSC or SSC users can update selected attibutes of other users ^Top
Management Policy Rule Configuration
Name DEEWR-Administration: ESS SEC or SD3 or SD1 or EPS or ACM or OSC or SSC users can update selected attibutes of other users
Description DEEWR-Administration: ESS SEC or SD3 or SD1 or EPS or ACM or OSC or SSC users can update selected attibutes of other users
Created Time 9/06/2011
Type Request
Grants Permissions True
Disabled False
Requestors and Operators
Requestor All DEEWR ESS SEC, SD3, SD1, EPS, OSC, ACM and SSC users
Operation Create, Modify, Add, Remove
Target Resources
Before Request All DEEWR Users
After Request All DEEWR Users
Resources Attributes ResetPassword, DEEWR-userAccountControl, DEEWR-esg-organisationID, DEEWR-esg-siteID, DEEWR-lockoutTime, DEEWR-unicodePwd, DEEWR-esg-roleID
52. DEEWR-Administration: ESS SEC or SD3 users can delete other users ^Top
Management Policy Rule Configuration
Name DEEWR-Administration: ESS SEC or SD3 users can delete other users
Description DEEWR-Administration: ESS SEC or SD3 users can delete other users
Created Time 9/06/2011
Type Request
Grants Permissions True
Disabled False
Requestors and Operators
Requestor All DEEWR ESS SEC and SD3 users
Operation Delete
Target Resources
Before Request All DEEWR Users
After Request (Attribute)
Resources Attributes All Attributes
53. DEEWR-Administration: ESS SEC or SD3 users can read selected attibutes of other users ^Top
Management Policy Rule Configuration
Name DEEWR-Administration: ESS SEC or SD3 users can read selected attibutes of other users
Description DEEWR-Administration: ESS SEC or SD3 users can read selected attibutes of other users
Created Time 9/06/2011
Type Request
Grants Permissions True
Disabled False
Requestors and Operators
Requestor All DEEWR ESS SEC and SD3 users
Operation Read
Target Resources
Before Request All DEEWR Users
After Request (Attribute)
Resources Attributes AccountName, DEEWR-esg-organisationID, DEEWR-esg-siteID, DEEWR-vasco-linkVascoUserToVascoDigipass, DisplayName, DEEWR-VascoDigipassData
54. DEEWR-Administration: ESS SEC or SD3 users can read DEEWR-esg-orgs ^Top
Management Policy Rule Configuration
Name DEEWR-Administration: ESS SEC or SD3 users can read DEEWR-esg-orgs
Description DEEWR-Administration: ESS SEC or SD3 users can read DEEWR-esg-orgs
Created Time 9/06/2011
Type Request
Grants Permissions True
Disabled False
Requestors and Operators
Requestor All DEEWR ESS SEC and SD3 users
Operation Read
Target Resources
Before Request All DEEWR-esg-orgs
After Request (Attribute)
Resources Attributes All Attributes
55. DEEWR-Administration: ESS SEC or SD3 users can read DEEWR-esg-sites ^Top
Management Policy Rule Configuration
Name DEEWR-Administration: ESS SEC or SD3 users can read DEEWR-esg-sites
Description DEEWR-Administration: ESS SEC or SD3 users can read DEEWR-esg-sites
Created Time 9/06/2011
Type Request
Grants Permissions True
Disabled False
Requestors and Operators
Requestor All DEEWR ESS SEC and SD3 users
Operation Read
Target Resources
Before Request All DEEWR-esg-sites
After Request (Attribute)
Resources Attributes All Attributes
56. DEEWR-Administration: ESS SEC or SD3 users can update selected attibutes of other users ^Top
Management Policy Rule Configuration
Name DEEWR-Administration: ESS SEC or SD3 users can update selected attibutes of other users
Description DEEWR-Administration: ESS SEC or SD3 users can update selected attibutes of other users
Created Time 9/06/2011
Type Request
Grants Permissions True
Disabled False
Requestors and Operators
Requestor All DEEWR ESS SEC and SD3 users
Operation Add, Remove, Modify
Target Resources
Before Request All DEEWR Users
After Request All DEEWR Users
Resources Attributes DEEWR-esg-siteID, DEEWR-esg-organisationID, DEEWR-vasco-linkVascoUserToVascoDigipass
57. DEEWR-Administration: Org OSCs can read and update Claims ^Top
Management Policy Rule Configuration
Name DEEWR-Administration: Org OSCs can read and update Claims
Description DEEWR-Administration: Org OSCs can read and update Claims
Created Time 12/07/2011
Type Request
Grants Permissions True
Disabled False
Requestors and Operators
Requestor All DEEWR ESS OSCs
Operation Add, Create, Delete, Modify, Read, Remove
Target Resources
Before Request All DEEWR Claims
After Request All DEEWR Claims
Resources Attributes All Attributes
58. DEEWR-Administration: Site SSCs can read and update Claims ^Top
Management Policy Rule Configuration
Name DEEWR-Administration: Site SSCs can read and update Claims
Description DEEWR-Administration: Site SSCs can read and update Claims
Created Time 12/07/2011
Type Request
Grants Permissions True
Disabled False
Requestors and Operators
Requestor All DEEWR ESS SSCs
Operation Add, Create, Delete, Modify, Read, Remove
Target Resources
Before Request All DEEWR Claims
After Request All DEEWR Claims
Resources Attributes All Attributes
59. DEEWR-Administration: Users can read all DEEWR-esg-userRoles ^Top
Management Policy Rule Configuration
Name DEEWR-Administration: Users can read all DEEWR-esg-userRoles
Description DEEWR-Administration: Users can read all DEEWR-esg-userRoles
Created Time 30/05/2011
Type Request
Grants Permissions True
Disabled False
Requestors and Operators
Requestor All DEEWR Users
Operation Read
Target Resources
Before Request All DEEWR-esg-userRoles
After Request (Attribute)
Resources Attributes All Attributes
60. DEEWR-Administration: Users can read DEEWR-esg-contracts ^Top
Management Policy Rule Configuration
Name DEEWR-Administration: Users can read DEEWR-esg-contracts
Description DEEWR-Administration: Users can read DEEWR-esg-contracts
Created Time 13/04/2011
Type Request
Grants Permissions True
Disabled False
Requestors and Operators
Requestor All DEEWR Users
Operation Read
Target Resources
Before Request All DEEWR-esg-contracts
After Request (Attribute)
Resources Attributes All Attributes
61. DEEWR-Administration: Users can read DEEWR-esg-orgs ^Top
Management Policy Rule Configuration
Name DEEWR-Administration: Users can read DEEWR-esg-orgs
Description DEEWR-Administration: Users can read DEEWR-esg-orgs
Created Time 13/04/2011
Type Request
Grants Permissions True
Disabled False
Requestors and Operators
Requestor All DEEWR Users
Operation Read
Target Resources
Before Request All DEEWR-esg-orgs
After Request (Attribute)
Resources Attributes All Attributes
62. DEEWR-Administration: Users can read DEEWR-esg-roles ^Top
Management Policy Rule Configuration
Name DEEWR-Administration: Users can read DEEWR-esg-roles
Description DEEWR-Administration: Users can read DEEWR-esg-roles
Created Time 13/04/2011
Type Request
Grants Permissions True
Disabled False
Requestors and Operators
Requestor All DEEWR Users
Operation Read
Target Resources
Before Request All DEEWR-esg-roles
After Request (Attribute)
Resources Attributes All Attributes
63. DEEWR-Administration: Users can read DEEWR-esg-sites ^Top
Management Policy Rule Configuration
Name DEEWR-Administration: Users can read DEEWR-esg-sites
Description DEEWR-Administration: Users can read DEEWR-esg-sites
Created Time 13/04/2011
Type Request
Grants Permissions True
Disabled False
Requestors and Operators
Requestor All DEEWR Users
Operation Read
Target Resources
Before Request All DEEWR-esg-sites
After Request (Attribute)
Resources Attributes All Attributes
64. DEEWR-Administration: Users can read DEEWR-subKeys ^Top
Management Policy Rule Configuration
Name DEEWR-Administration: Users can read DEEWR-subKeys
Description Administration: Users can read DEEWR-subKeys
Created Time 27/06/2011
Type Request
Grants Permissions True
Disabled False
Requestors and Operators
Requestor All DEEWR Users
Operation Read
Target Resources
Before Request All DEEWR sub keys
After Request (Attribute)
Resources Attributes All Attributes
65. DEEWR-Administration:ESS SEC or OSC or SSC users can update selected attibutes of their own ^Top
Management Policy Rule Configuration
Name DEEWR-Administration:ESS SEC or OSC or SSC users can update selected attibutes of their own
Description DEEWR-Administration:ESS SEC or OSC or SSC users can update selected attibutes of their own
Created Time 10/06/2011
Type Request
Grants Permissions True
Disabled False
Requestors and Operators
Requestor ALL DEEWR ESS SEC or OSC or SSC users
Operation Add, Remove
Target Resources
Before Request All DEEWR Users
After Request All DEEWR Users
Resources Attributes DEEWR-esg-securityReports
66. DEEWR-Administration:Org OSCs can create users ^Top
Management Policy Rule Configuration
Name DEEWR-Administration:Org OSCs can create users
Description
Created Time 12/07/2011
Type Request
Grants Permissions True
Disabled False
Requestors and Operators
Requestor All DEEWR ESS OSCs
Operation Create
Target Resources
Before Request (Attribute)
After Request All DEEWR Users
Resources Attributes All Attributes
67. DEEWR-Administration:Site SSCs can create users ^Top
Management Policy Rule Configuration
Name DEEWR-Administration:Site SSCs can create users
Description DEEWR-Administration:Site SSCs can create users
Created Time 12/07/2011
Type Request
Grants Permissions True
Disabled False
Requestors and Operators
Requestor All DEEWR ESS SSCs
Operation Create
Target Resources
Before Request All DEEWR Users
After Request All DEEWR Users
Resources Attributes All Attributes
68. DEEWR-All claims with missing references are deleted ^Top
Management Policy Rule Configuration
Name DEEWR-All claims with missing references are deleted
Description All claims with missing references (which are therefore invalid) are deleted
Created Time 24/06/2011
Type Set Transition
Grants Permissions False
Disabled False
Transition Definition
Transition Type Transition In
Transition Set All DEEWR invalid claims to be deleted
Policy Workflows
Type Display Name
Action DEEWR-Delete Object by ID
69. DEEWR-All claims with no claim values are deleted ^Top
Management Policy Rule Configuration
Name DEEWR-All claims with no claim values are deleted
Description All claims with no claim values are deleted
Created Time 30/06/2011
Type Set Transition
Grants Permissions False
Disabled False
Transition Definition
Transition Type Transition In
Transition Set All DEEWR Claims with invalid values
Policy Workflows
Type Display Name
Action DEEWR-Delete Object by ID
70. DEEWR-All empty user role assignments are removed ^Top
Management Policy Rule Configuration
Name DEEWR-All empty user role assignments are removed
Description Housekeeping task to clean up user role assignments with no target orgs/roles/etc. Couldn't get this to work without compromising other policies ... needs more thought and may actually not be required
Created Time 31/05/2011
Type Set Transition
Grants Permissions False
Disabled True
Transition Definition
Transition Type Transition In
Transition Set All empty DEEWR user role assignments
Policy Workflows
Type Display Name
Action DEEWR-Remove user role assignment by ID
71. DEEWR-Claims are updated with referenced display names ^Top
Management Policy Rule Configuration
Name DEEWR-Claims are updated with referenced display names
Description Claims need to store the display names of each referenced object to sync with SQL
Created Time 19/04/2011
Type Request
Grants Permissions False
Disabled False
Requestors and Operators
Requestor DEEWR-Forefront Identity Manager Service Account
Operation Create, Add, Modify, Remove
Target Resources
Before Request All DEEWR-esg-claims with valid references
After Request All DEEWR-esg-claims with valid references
Resources Attributes DEEWR-applicationID, DEEWR-claimTypeID, DEEWR-userID, ObjectID, DEEWR-subKeyID, DEEWR-claimValueID
Policy Workflows
Type Display Name
Action DEEWR - Event Broker Data Changes
Action DEEWR-Set claim sync values
72. DEEWR-Claims for ADMIN ROLES are created or updated for a user ^Top
Management Policy Rule Configuration
Name DEEWR-Claims for ADMIN ROLES are created or updated for a user
Description Generate claims data for ADMIN ROLE assignments to people
Created Time 1/06/2011
Type Request
Grants Permissions False
Disabled False
Requestors and Operators
Requestor All DEEWR claim administrators and FIM services
Operation Add, Create, Remove
Target Resources
Before Request All DEEWR Users
After Request ALL DEEWR Users with valid ADMIN ROLE claims
Resources Attributes DEEWR-roleID, DEEWR-appID
Policy Workflows
Type Display Name
Action DEEWR-Create or update user ADMIN ROLE claims
73. DEEWR-Claims for ADMIN ROLES are removed for a user ^Top
Management Policy Rule Configuration
Name DEEWR-Claims for ADMIN ROLES are removed for a user
Description Claims for ADMIN ROLES are removed for a user when the last admin role is deleted for that user
Created Time 2/06/2011
Type Request
Grants Permissions False
Disabled False
Requestors and Operators
Requestor All DEEWR claim administrators and FIM services
Operation Remove
Target Resources
Before Request All DEEWR users WITH valid ADMIN ROLEs
After Request All DEEWR users WITHOUT valid ADMIN ROLEs
Resources Attributes DEEWR-roleID
Policy Workflows
Type Display Name
Action DEEWR-Delete user ADMIN ROLE claims
74. DEEWR-Claims for ORGS are created or updated for a user ^Top
Management Policy Rule Configuration
Name DEEWR-Claims for ORGS are created or updated for a user
Description Generate claims data for ORG assignments to people
Created Time 21/04/2011
Type Request
Grants Permissions False
Disabled False
Requestors and Operators
Requestor All DEEWR claim administrators and FIM services
Operation Add, Remove, Create
Target Resources
Before Request All DEEWR Users
After Request ALL DEEWR Users with valid ORG claims
Resources Attributes DEEWR-esg-organisationID, DEEWR-appID
Policy Workflows
Type Display Name
Action DEEWR-Create or update user ESG ORG claims
75. DEEWR-Claims for ORGS are removed for a user ^Top
Management Policy Rule Configuration
Name DEEWR-Claims for ORGS are removed for a user
Description Claims for ORGS are removed for a user
Created Time 28/06/2011
Type Request
Grants Permissions False
Disabled True
Requestors and Operators
Requestor All DEEWR claim administrators and FIM services
Operation Remove
Target Resources
Before Request All DEEWR Users
After Request All DEEWR Users
Resources Attributes DEEWR-esg-organisationID, DEEWR-appID
Policy Workflows
Type Display Name
Action DEEWR-Delete user ESG ORG claims
76. DEEWR-Claims for ROLES are created or updated for a user ^Top
Management Policy Rule Configuration
Name DEEWR-Claims for ROLES are created or updated for a user
Description Generate claims data for ROLE assignments to people
Created Time 20/04/2011
Type Request
Grants Permissions False
Disabled False
Requestors and Operators
Requestor All DEEWR claim administrators and FIM services
Operation Add, Remove, Create
Target Resources
Before Request All DEEWR Users
After Request ALL DEEWR Users with valid ROLE claims
Resources Attributes DEEWR-esg-roleID, DEEWR-appID
Policy Workflows
Type Display Name
Action DEEWR-Create or update user ESG ROLE claims
77. DEEWR-Claims for ROLES are removed for a user ^Top
Management Policy Rule Configuration
Name DEEWR-Claims for ROLES are removed for a user
Description Claims for ROLES are removed for a user
Created Time 28/06/2011
Type Request
Grants Permissions False
Disabled True
Requestors and Operators
Requestor All DEEWR claim administrators and FIM services
Operation Remove
Target Resources
Before Request All DEEWR Users
After Request All DEEWR Users
Resources Attributes DEEWR-esg-roleID, DEEWR-appID
Policy Workflows
Type Display Name
Action DEEWR-Delete user ESG ROLE claims
78. DEEWR-Claims for SITES are created or updated for a user ^Top
Management Policy Rule Configuration
Name DEEWR-Claims for SITES are created or updated for a user
Description Generate and maintain claims data for SITE assignments to people
Created Time 21/04/2011
Type Request
Grants Permissions False
Disabled False
Requestors and Operators
Requestor All DEEWR claim administrators and FIM services
Operation Add, Create, Remove
Target Resources
Before Request All DEEWR Users
After Request All DEEWR Users with valid SITE claims
Resources Attributes DEEWR-esg-siteID, DEEWR-appID
Policy Workflows
Type Display Name
Action DEEWR-Create or update user ESG SITE claims
79. DEEWR-Claims for SITES are removed for a user ^Top
Management Policy Rule Configuration
Name DEEWR-Claims for SITES are removed for a user
Description Claims for SITES are removed for a user
Created Time 28/06/2011
Type Request
Grants Permissions False
Disabled True
Requestors and Operators
Requestor All DEEWR claim administrators and FIM services
Operation Remove
Target Resources
Before Request All DEEWR Users
After Request All DEEWR Users
Resources Attributes DEEWR-esg-siteID, DEEWR-appID
Policy Workflows
Type Display Name
Action DEEWR-Delete user ESG SITE claims
80. DEEWR-Claims which are invalid for a given ORG and APPLICATION are deleted for a user ^Top
Management Policy Rule Configuration
Name DEEWR-Claims which are invalid for a given ORG and APPLICATION are deleted for a user
Description Claims for ORGS, SITES, CONTRACTS and ROLES are deleted for a user where there is no longer a match on ORG and APPLICATION
Created Time 6/05/2011
Type Request
Grants Permissions False
Disabled True
Requestors and Operators
Requestor All DEEWR Claim administrators
Operation Add
Target Resources
Before Request ALL DEEWR Users with valid ORG claims
After Request All DEEWR Users
Resources Attributes DEEWR-esg-organisationID
Policy Workflows
Type Display Name
Action DEEWR-Delete invalid user claims for Org and Application
81. DEEWR-Derive display name and description for user role assignments ^Top
Management Policy Rule Configuration
Name DEEWR-Derive display name and description for user role assignments
Description Derive display name and description for user role assignments
Created Time 8/07/2011
Type Request
Grants Permissions False
Disabled False
Requestors and Operators
Requestor All DEEWR ESS Admins
Operation Create, Modify, Add, Remove
Target Resources
Before Request All DEEWR-esg-userRoles
After Request All DEEWR-esg-userRoles
Resources Attributes DEEWR-assignedRoleID, DEEWR-userID, ObjectID, DEEWR-esg-targetID
Policy Workflows
Type Display Name
Action DEEWR-Set derived DisplayName and Description for DEEWR-esg-userRole records
82. DEEWR-ESS Admins can create and update nominated DEEWR-esg-userRole attributes ^Top
Management Policy Rule Configuration
Name DEEWR-ESS Admins can create and update nominated DEEWR-esg-userRole attributes
Description ESS Admins can create and update nominated DEEWR-esg-userRole attributes
Created Time 7/07/2011
Type Request
Grants Permissions True
Disabled False
Requestors and Operators
Requestor All DEEWR ESS Admins
Operation Add, Modify, Remove, Create
Target Resources
Before Request All DEEWR-esg-userRoles
After Request All DEEWR-esg-userRoles
Resources Attributes All Attributes
83. DEEWR-FIM workflow changes to users trigger Event Broker ^Top
Management Policy Rule Configuration
Name DEEWR-FIM workflow changes to users trigger Event Broker
Description FIM workflow changes to users trigger Event Broker
Created Time 7/07/2011
Type Request
Grants Permissions False
Disabled False
Requestors and Operators
Requestor DEEWR-Forefront Identity Manager Service Account
Operation Add, Create, Delete, Modify, Remove
Target Resources
Before Request All DEEWR Users
After Request All DEEWR Users
Resources Attributes All Attributes
Policy Workflows
Type Display Name
Action DEEWR - Event Broker Data Changes
84. DEEWR-Initial password is cleared after user is first provisioned to AD ^Top
Management Policy Rule Configuration
Name DEEWR-Initial password is cleared after user is first provisioned to AD
Description Initial password is cleared after user is first provisioned to AD
Created Time 7/07/2011
Type Request
Grants Permissions False
Disabled False
Requestors and Operators
Requestor Synchronization Engine
Operation Modify
Target Resources
Before Request All DEEWR users with passwords being reset
After Request All DEEWR Users
Resources Attributes ObjectSID
Policy Workflows
Type Display Name
Action DEEWR-Clean up after user account is provisioned
85. DEEWR-Invalid esg roles for sites are removed ^Top
Management Policy Rule Configuration
Name DEEWR-Invalid esg roles for sites are removed
Description Invalid esg roles for sites are removed
Created Time 11/05/2011
Type Request
Grants Permissions False
Disabled True
Requestors and Operators
Requestor All DEEWR Claim administrators
Operation Remove, Add
Target Resources
Before Request All People
After Request All People
Resources Attributes DEEWR-esg-siteID
Policy Workflows
Type Display Name
Action DEEWR-Remove invalid esg roles for user sites
86. DEEWR-Invalid esg sites and roles for org are removed ^Top
Management Policy Rule Configuration
Name DEEWR-Invalid esg sites and roles for org are removed
Description Site and role selections for a user are removed if they no longer match the selected org
Created Time 6/05/2011
Type Request
Grants Permissions False
Disabled True
Requestors and Operators
Requestor All DEEWR Claim administrators
Operation Remove, Add
Target Resources
Before Request All People
After Request All People
Resources Attributes DEEWR-esg-organisationID
Policy Workflows
Type Display Name
Action DEEWR-Remove invalid esg sites and roles for user orgs
87. DEEWR-Invitations where invitee cannot be resolved are deleted ^Top
Management Policy Rule Configuration
Name DEEWR-Invitations where invitee cannot be resolved are deleted
Description All DEEWR invitations where invitee cannot be resolved are deleted
Created Time 13/05/2011
Type Set Transition
Grants Permissions False
Disabled False
Transition Definition
Transition Type Transition In
Transition Set DEEWR-All invitations that failed to resolve
Policy Workflows
Type Display Name
Action DEEWR-Delete invitation where invitee not resolved
88. DEEWR-Invitees are resolved for new invitations ^Top
Management Policy Rule Configuration
Name DEEWR-Invitees are resolved for new invitations
Description Resolve the user ID for a new invitation
Created Time 13/05/2011
Type Request
Grants Permissions False
Disabled False
Requestors and Operators
Requestor All DEEWR ESS SD3 and OSC users
Operation Create, Modify
Target Resources
Before Request DEEWR-All unresolved invitations
After Request All DEEWR-esg-invitations
Resources Attributes DEEWR-esg-invitee
Policy Workflows
Type Display Name
Action DEEWR-Resolve org invitee
89. DEEWR-Notify new invitations ^Top
Management Policy Rule Configuration
Name DEEWR-Notify new invitations
Description WIP - need to work out where to direct these, but for now just use inviter
Created Time 17/05/2011
Type Set Transition
Grants Permissions False
Disabled False
Transition Definition
Transition Type Transition In
Transition Set DEEWR-Invitations with resolved invitees
Policy Workflows
Type Display Name
Action DEEWR-Notify invitee resolved OK
90. DEEWR-Org OSCs can administer users from their own Orgs ^Top
Management Policy Rule Configuration
Name DEEWR-Org OSCs can administer users from their own Orgs
Description
Created Time 17/05/2011
Type Request
Grants Permissions True
Disabled False
Requestors and Operators
Requestor DEEWR-esg-orgUserID (Attribute)
Operation Add, Create, Delete, Modify, Read, Remove
Target Resources
Before Request All DEEWR Users
After Request All DEEWR Users
Resources Attributes All Attributes
91. DEEWR-Org users are updated with the matching OSC IDs ^Top
Management Policy Rule Configuration
Name DEEWR-Org users are updated with the matching OSC IDs
Description ORG users are updated with the matching OSC IDs
Created Time 17/05/2011
Type Request
Grants Permissions False
Disabled False
Requestors and Operators
Requestor DEEWR-Forefront Identity Manager Service Account
Operation Add, Create, Remove
Target Resources
Before Request All DEEWR Org Claims
After Request All DEEWR Org Claims
Resources Attributes DEEWR-claimValueID
Policy Workflows
Type Display Name
Action DEEWR-Set OSCs for a user
92. DEEWR-Outbound policy for Claims to SQL ^Top
Management Policy Rule Configuration
Name DEEWR-Outbound policy for Claims to SQL
Description Claims are provisioned to SQL
Created Time 19/04/2011
Type Set Transition
Grants Permissions False
Disabled False
Transition Definition
Transition Type Transition In
Transition Set DEEWR-All valid claims
Policy Workflows
Type Display Name
Action DEEWR - Event Broker Data Changes
Action DEEWR-Outbound workflow for Claims to SQL
93. DEEWR-Outbound Policy for Users to AD ^Top
Management Policy Rule Configuration
Name DEEWR-Outbound Policy for Users to AD
Description Outbound Policy for Users to AD
Created Time 9/06/2011
Type Set Transition
Grants Permissions False
Disabled False
Transition Definition
Transition Type Transition In
Transition Set All DEEWR Domain users for provisioning
Policy Workflows
Type Display Name
Action DEEWR-Outbound Workflow for Users to AD
Action DEEWR - Event Broker Data Changes
94. DEEWR-Password administrators reset passwords on behalf of others ^Top
Management Policy Rule Configuration
Name DEEWR-Password administrators reset passwords on behalf of others
Description Outbound policy to allow admins to reset user account passwords
Created Time 9/06/2011
Type Request
Grants Permissions True
Disabled False
Requestors and Operators
Requestor All DEEWR Password admins
Operation Modify
Target Resources
Before Request All DEEWR Users
After Request All DEEWR users with passwords being reset
Resources Attributes DEEWR-unicodePwd
Policy Workflows
Type Display Name
Action DEEWR-Reset user account password
95. DEEWR-Rejected invitations are deleted ^Top
Management Policy Rule Configuration
Name DEEWR-Rejected invitations are deleted
Description
Created Time 16/05/2011
Type Request
Grants Permissions False
Disabled False
Requestors and Operators
Requestor All DEEWR ESS SD3 and OSC users
Operation Modify
Target Resources
Before Request All DEEWR-esg-invitations
After Request DEEWR-All rejected invitations
Resources Attributes DEEWR-esg-isAccepted
Policy Workflows
Type Display Name
Action DEEWR-Delete rejected invitation
96. DEEWR-SECs can createGlobal DEEWR-Templates ^Top
Management Policy Rule Configuration
Name DEEWR-SECs can createGlobal DEEWR-Templates
Description DEEWR-SECs can create Global DEEWR-Templates
Created Time 9/06/2011
Type Request
Grants Permissions True
Disabled False
Requestors and Operators
Requestor All DEEWR ESS SEC users
Operation Create
Target Resources
Before Request (Attribute)
After Request All DEEWR-esg-Global Role Templates
Resources Attributes All Attributes
97. DEEWR-SECs can delete Global DEEWR-Templates ^Top
Management Policy Rule Configuration
Name DEEWR-SECs can delete Global DEEWR-Templates
Description DEEWR-SECs can delete Global DEEWR-Templates
Created Time 9/06/2011
Type Request
Grants Permissions True
Disabled False
Requestors and Operators
Requestor All DEEWR ESS SEC users
Operation Delete
Target Resources
Before Request All DEEWR-esg-Global Role Templates
After Request (Attribute)
Resources Attributes All Attributes
98. DEEWR-SECs can read Global DEEWR-Templates ^Top
Management Policy Rule Configuration
Name DEEWR-SECs can read Global DEEWR-Templates
Description DEEWR-SECs can read Global DEEWR-Templates
Created Time 9/06/2011
Type Request
Grants Permissions True
Disabled False
Requestors and Operators
Requestor All DEEWR ESS SEC users
Operation Read
Target Resources
Before Request All DEEWR-esg-Global Role Templates
After Request (Attribute)
Resources Attributes All Attributes
99. DEEWR-SECs can update Global DEEWR-Templates ^Top
Management Policy Rule Configuration
Name DEEWR-SECs can update Global DEEWR-Templates
Description DEEWR-SECs can update Global DEEWR-Templates
Created Time 9/06/2011
Type Request
Grants Permissions True
Disabled False
Requestors and Operators
Requestor All DEEWR ESS SEC users
Operation Add, Modify, Remove
Target Resources
Before Request All DEEWR-esg-Global Role Templates
After Request All DEEWR-esg-Global Role Templates
Resources Attributes All Attributes
100. DEEWR-Site SSCs can administer users from their own Sites ^Top
Management Policy Rule Configuration
Name DEEWR-Site SSCs can administer users from their own Sites
Description
Created Time 17/05/2011
Type Request
Grants Permissions True
Disabled False
Requestors and Operators
Requestor DEEWR-esg-siteUserID (Attribute)
Operation Add, Create, Delete, Modify, Read, Remove
Target Resources
Before Request All DEEWR Users
After Request All DEEWR Users
Resources Attributes All Attributes
101. DEEWR-Site users are updated with the matching SSC IDs ^Top
Management Policy Rule Configuration
Name DEEWR-Site users are updated with the matching SSC IDs
Description SITE users are updated with the matching SSC IDs
Created Time 17/05/2011
Type Request
Grants Permissions False
Disabled False
Requestors and Operators
Requestor DEEWR-Forefront Identity Manager Service Account
Operation Add, Create, Remove
Target Resources
Before Request All DEEWR Site Claims
After Request All DEEWR Site Claims
Resources Attributes DEEWR-claimValueID
Policy Workflows
Type Display Name
Action DEEWR-Set SSCs for a user
102. DEEWR-Synchronisation: Synchronisation Engine can control DEEWR-esg-contracts ^Top
Management Policy Rule Configuration
Name DEEWR-Synchronisation: Synchronisation Engine can control DEEWR-esg-contracts
Description DEEWR-Synchronisation: Synchronisation Engine can control DEEWR-esg-contracts
Created Time 23/02/2011
Type Request
Grants Permissions True
Disabled False
Requestors and Operators
Requestor Synchronization Engine
Operation Add, Create, Modify, Read, Remove, Delete
Target Resources
Before Request All DEEWR-esg-contracts
After Request All DEEWR-esg-contracts
Resources Attributes All Attributes
Policy Workflows
Type Display Name
Action DEEWR - Event Broker Data Changes
103. DEEWR-Synchronisation: Synchronisation Engine can control DEEWR-esg-orgs ^Top
Management Policy Rule Configuration
Name DEEWR-Synchronisation: Synchronisation Engine can control DEEWR-esg-orgs
Description DEEWR-Synchronisation: Synchronisation Engine can control DEEWR-esg-orgs
Created Time 23/02/2011
Type Request
Grants Permissions True
Disabled False
Requestors and Operators
Requestor Synchronization Engine
Operation Add, Create, Modify, Read, Remove, Delete
Target Resources
Before Request All DEEWR-esg-orgs
After Request All DEEWR-esg-orgs
Resources Attributes All Attributes
Policy Workflows
Type Display Name
Action DEEWR - Event Broker Data Changes
104. DEEWR-Synchronisation: Synchronisation Engine can control DEEWR-esg-roles ^Top
Management Policy Rule Configuration
Name DEEWR-Synchronisation: Synchronisation Engine can control DEEWR-esg-roles
Description DEEWR-Synchronisation: Synchronisation Engine can control DEEWR-esg-roles
Created Time 11/04/2011
Type Request
Grants Permissions True
Disabled False
Requestors and Operators
Requestor Synchronization Engine
Operation Add, Create, Modify, Read, Remove, Delete
Target Resources
Before Request All DEEWR-esg-roles
After Request All DEEWR-esg-roles
Resources Attributes All Attributes
Policy Workflows
Type Display Name
Action DEEWR - Event Broker Data Changes
105. DEEWR-Synchronisation: Synchronisation Engine can control DEEWR-esg-roleTemplates ^Top
Management Policy Rule Configuration
Name DEEWR-Synchronisation: Synchronisation Engine can control DEEWR-esg-roleTemplates
Description DEEWR-Synchronisation: Synchronisation Engine can control DEEWR-esg-roleTemplates
Created Time 6/05/2011
Type Request
Grants Permissions True
Disabled False
Requestors and Operators
Requestor Synchronization Engine
Operation Add, Create, Delete, Modify, Read, Remove
Target Resources
Before Request All DEEWR-esg-roleTemplates
After Request All DEEWR-esg-roleTemplates
Resources Attributes All Attributes
Policy Workflows
Type Display Name
Action DEEWR - Event Broker Data Changes
106. DEEWR-Synchronisation: Synchronisation Engine can control DEEWR-esg-sites ^Top
Management Policy Rule Configuration
Name DEEWR-Synchronisation: Synchronisation Engine can control DEEWR-esg-sites
Description DEEWR-Synchronisation: Synchronisation Engine can control DEEWR-esg-sites
Created Time 23/02/2011
Type Request
Grants Permissions True
Disabled False
Requestors and Operators
Requestor Synchronization Engine
Operation Add, Create, Modify, Read, Remove, Delete
Target Resources
Before Request All DEEWR-esg-sites
After Request All DEEWR-esg-sites
Resources Attributes All Attributes
Policy Workflows
Type Display Name
Action DEEWR - Event Broker Data Changes
107. DEEWR-Synchronisation: Synchronisation Engine can control DEEWR-vasco-DPTokens ^Top
Management Policy Rule Configuration
Name DEEWR-Synchronisation: Synchronisation Engine can control DEEWR-vasco-DPTokens
Description DEEWR-Synchronisation: Synchronisation Engine can control DEEWR-vasco-DPTokens
Created Time 23/05/2011
Type Request
Grants Permissions True
Disabled False
Requestors and Operators
Requestor Synchronization Engine
Operation Add, Create, Delete, Modify, Read, Remove
Target Resources
Before Request All DEEWR-vasco-DPTokens
After Request All DEEWR-vasco-DPTokens
Resources Attributes All Attributes
108. DEEWR-Synchronisation: Synchronisation Engine can read and update Applications ^Top
Management Policy Rule Configuration
Name DEEWR-Synchronisation: Synchronisation Engine can read and update Applications
Description DEEWR-Synchronisation: Synchronisation Engine can read and update Applications
Created Time 9/03/2011
Type Request
Grants Permissions True
Disabled False
Requestors and Operators
Requestor Synchronization Engine
Operation Add, Create, Delete, Modify, Read, Remove
Target Resources
Before Request All DEEWR-apps
After Request All DEEWR-apps
Resources Attributes All Attributes
109. DEEWR-Synchronisation: Synchronisation Engine can read and update Claims ^Top
Management Policy Rule Configuration
Name DEEWR-Synchronisation: Synchronisation Engine can read and update Claims
Description DEEWR-Synchronisation: Synchronisation Engine can read and update Claims
Created Time 9/03/2011
Type Request
Grants Permissions True
Disabled False
Requestors and Operators
Requestor Synchronization Engine
Operation Add, Create, Delete, Modify, Read, Remove
Target Resources
Before Request All DEEWR Claims
After Request All DEEWR Claims
Resources Attributes All Attributes
Policy Workflows
Type Display Name
Action DEEWR - Event Broker Data Changes
110. DEEWR-Synchronisation: Synchronisation Engine can read and update claimTypes ^Top
Management Policy Rule Configuration
Name DEEWR-Synchronisation: Synchronisation Engine can read and update claimTypes
Description DEEWR-Synchronisation: Synchronisation Engine can read and update claimTypes
Created Time 16/03/2011
Type Request
Grants Permissions True
Disabled False
Requestors and Operators
Requestor Synchronization Engine
Operation Add, Create, Delete, Modify, Read, Remove
Target Resources
Before Request All DEEWR-claimTypes
After Request All DEEWR-claimTypes
Resources Attributes All Attributes
111. DEEWR-Synchronisation: Synchronisation Engine can read and update DEEWR-esg-generalRoles ^Top
Management Policy Rule Configuration
Name DEEWR-Synchronisation: Synchronisation Engine can read and update DEEWR-esg-generalRoles
Description Synchronisation Engine can read and update DEEWR-esg-generalRoles
Created Time 5/04/2011
Type Request
Grants Permissions True
Disabled False
Requestors and Operators
Requestor Synchronization Engine
Operation Add, Create, Modify, Read, Remove
Target Resources
Before Request (Attribute)
After Request (Attribute)
Resources Attributes All Attributes
112. DEEWR-Synchronisation: Synchronisation Engine can read and update DEEWR-esg-reportingRoles ^Top
Management Policy Rule Configuration
Name DEEWR-Synchronisation: Synchronisation Engine can read and update DEEWR-esg-reportingRoles
Description Synchronisation Engine can read and update DEEWR-esg-reportingRoles
Created Time 5/04/2011
Type Request
Grants Permissions True
Disabled False
Requestors and Operators
Requestor Synchronization Engine
Operation Add, Create, Modify, Read, Remove
Target Resources
Before Request (Attribute)
After Request (Attribute)
Resources Attributes All Attributes
113. DEEWR-Synchronization: Synchronization account controls users it synchronizes ^Top
Management Policy Rule Configuration
Name DEEWR-Synchronization: Synchronization account controls users it synchronizes
Description DEEWR-Synchronization: Synchronization account controls users it synchronizes
Created Time 18/05/2011
Type Request
Grants Permissions True
Disabled False
Requestors and Operators
Requestor Synchronization Engine
Operation Add, Create, Delete, Modify, Remove
Target Resources
Before Request All DEEWR Users
After Request All DEEWR Users
Resources Attributes DEEWR-codeWord, DEEWR-DeptID, DEEWR-esg-contractID, DEEWR-esg-extOrgCode, DEEWR-esg-organisationID, DEEWR-esg-orgCodeID, DEEWR-esg-orgID, DEEWR-esg-roleID, DEEWR-esg-roleName, DEEWR-esg-roleType, DEEWR-esg-siteID, DEEWR-esg-siteName, DEEWR-freindlyNames, DEEWR-uid, DEEWR-userAccountControl, DEEWR-friendlyNames, DEEWR-info, DEEWR-VascoDigipassData, DEEWR-vasco-linkVascoUserToVascoDigipass, DEEWR-roleID, DEEWR-lockoutTime, DEEWR-unicodePwd, DEEWR-selfServicePassword, DEEWR-esg-securityReports, DEEWR-isActive, DEEWR-lastLogonDatetime
114. DEEWR-Synchronization: Synchronization engine can read and update DEEWR-roles ^Top
Management Policy Rule Configuration
Name DEEWR-Synchronization: Synchronization engine can read and update DEEWR-roles
Description Synchronization engine can read and update DEEWR-roles
Created Time 8/06/2011
Type Request
Grants Permissions True
Disabled False
Requestors and Operators
Requestor Synchronization Engine
Operation Add, Create, Delete, Modify, Remove
Target Resources
Before Request All DEEWR-roles
After Request All DEEWR-roles
Resources Attributes All Attributes
115. DEEWR-User Management: Developers can read and update DEEWR-esg-roles ^Top
Management Policy Rule Configuration
Name DEEWR-User Management: Developers can read and update DEEWR-esg-roles
Description User Management: Developers can read and update DEEWR-esg-roles
Created Time 14/04/2011
Type Request
Grants Permissions True
Disabled False
Requestors and Operators
Requestor All DEEWR Developers
Operation Add, Create, Delete, Read, Remove
Target Resources
Before Request All DEEWR-esg-roles
After Request All DEEWR-esg-roles
Resources Attributes All Attributes
Policy Workflows
Type Display Name
Action DEEWR - Event Broker Data Changes
116. DEEWR-User management: ESS EMS Users can update selected attributes of their own ^Top
Management Policy Rule Configuration
Name DEEWR-User management: ESS EMS Users can update selected attributes of their own
Description DEEWR-User management: ESS EMS Users can update selected attributes of their own
Created Time 9/06/2011
Type Request
Grants Permissions True
Disabled False
Requestors and Operators
Requestor ObjectID (Attribute)
Operation Add, Remove, Modify
Target Resources
Before Request All DEEWR ESS EMS users
After Request All DEEWR ESS EMS users
Resources Attributes DEEWR-roleID, DEEWR-esg-organisationID, DEEWR-esg-siteID, DEEWR-lockoutTime, DEEWR-selfServicePassword, DEEWR-esg-securityReports
117. DEEWR-User management: Users can read attributes of their own ^Top
Management Policy Rule Configuration
Name DEEWR-User management: Users can read attributes of their own
Description DEEWR User management: Users can read attributes of their own
Created Time 19/05/2011
Type Request
Grants Permissions True
Disabled False
Requestors and Operators
Requestor ObjectID (Attribute)
Operation Read
Target Resources
Before Request All DEEWR Users
After Request (Attribute)
Resources Attributes DEEWR-codeWord, DEEWR-esg-contractID, DEEWR-esg-organisationID, DEEWR-esg-roleID, DEEWR-esg-siteID, DEEWR-freindlyNames, DEEWR-info, whenCreated, lastLogon, AccountName, DEEWR-friendlyNames, DEEWR-selfServicePassword, DisplayName, Domain, Email, FirstName, LastName, MobilePhone, OfficePhone, OfficeFax, DEEWR-unicodePwd
118. DEEWR-User management: Users can read DEEWR-esg-invitations ^Top
Management Policy Rule Configuration
Name DEEWR-User management: Users can read DEEWR-esg-invitations
Description DEEWR-User management: Users can read DEEWR-esg-invitations
Created Time 8/06/2011
Type Request
Grants Permissions True
Disabled False
Requestors and Operators
Requestor All DEEWR Users
Operation Read
Target Resources
Before Request All DEEWR-esg-invitations
After Request (Attribute)
Resources Attributes All Attributes
119. DEEWR-User management: Users can read selected attributes of other users ^Top
Management Policy Rule Configuration
Name DEEWR-User management: Users can read selected attributes of other users
Description
Created Time 19/05/2011
Type Request
Grants Permissions True
Disabled True
Requestors and Operators
Requestor All DEEWR Users
Operation Read
Target Resources
Before Request All People
After Request (Attribute)
Resources Attributes DEEWR-applicationID, DEEWR-codeWord, DEEWR-esg-contractID, DEEWR-esg-organisationID, DEEWR-esg-roleID, DEEWR-esg-siteID, DEEWR-freindlyNames, DEEWR-info, DEEWR-roleID, DEEWR-userAccountControl, whenCreated
120. DEEWR-User management: Users can update selected attributes of DEEWR-esg-invitations ^Top
Management Policy Rule Configuration
Name DEEWR-User management: Users can update selected attributes of DEEWR-esg-invitations
Description DEEWR-User management: Users can update selected attributes of DEEWR-esg-invitations
Created Time 8/06/2011
Type Request
Grants Permissions True
Disabled False
Requestors and Operators
Requestor All DEEWR Users
Operation Modify
Target Resources
Before Request All DEEWR-esg-invitations
After Request All DEEWR-esg-invitations
Resources Attributes DEEWR-esg-isAccepted
121. DEEWR-User management: Users can update selected attributes of their own ^Top
Management Policy Rule Configuration
Name DEEWR-User management: Users can update selected attributes of their own
Description DEEWR User management: Users can update selected attributes of their own
Created Time 19/05/2011
Type Request
Grants Permissions True
Disabled False
Requestors and Operators
Requestor ObjectID (Attribute)
Operation Modify
Target Resources
Before Request All DEEWR Users
After Request All DEEWR Users
Resources Attributes DEEWR-codeWord, MobilePhone, OfficeFax, OfficePhone, DEEWR-info
122. DEEWR-User reset password rule is removed after reset ^Top
Management Policy Rule Configuration
Name DEEWR-User reset password rule is removed after reset
Description User reset password rule is removed after reset
Created Time 7/07/2011
Type Request
Grants Permissions False
Disabled False
Requestors and Operators
Requestor Synchronization Engine
Operation Add
Target Resources
Before Request All DEEWR Users
After Request All DEEWR Users with reset password DREs
Resources Attributes DetectedRulesList
Policy Workflows
Type Display Name
Action DEEWR-Clean up after user account password is reset
123. DEEWR-User roles are synchronised with non-OSC and SSC role assignments ^Top
Management Policy Rule Configuration
Name DEEWR-User roles are synchronised with non-OSC and SSC role assignments
Description
Created Time 8/07/2011
Type Request
Grants Permissions False
Disabled False
Requestors and Operators
Requestor All DEEWR ESS Admins
Operation Add, Create, Delete, Modify, Remove
Target Resources
Before Request All DEEWR-esg-userRoles
After Request All DEEWR user role assignments which exclude OSC and SSC
Resources Attributes All Attributes
Policy Workflows
Type Display Name
Action DEEWR-Sync user roles
124. DEEWR-Users are updated with a new OSC ^Top
Management Policy Rule Configuration
Name DEEWR-Users are updated with a new OSC
Description An OSC is added to each user which falls under the same org scope as the org(s) added for that OSC
Created Time 18/05/2011
Type Request
Grants Permissions False
Disabled False
Requestors and Operators
Requestor All DEEWR Users
Operation Add, Create
Target Resources
Before Request All DEEWR OSC Org Assignments
After Request All DEEWR OSC Org Assignments
Resources Attributes DEEWR-esg-targetID
Policy Workflows
Type Display Name
Action DEEWR-Add org admins for an OSC
125. DEEWR-Users are updated with a new SSC ^Top
Management Policy Rule Configuration
Name DEEWR-Users are updated with a new SSC
Description An SSC is added to each user which falls under the same site scope as the site(s) added for that SSC
Created Time 18/05/2011
Type Request
Grants Permissions False
Disabled False
Requestors and Operators
Requestor All DEEWR Users
Operation Add, Create
Target Resources
Before Request All DEEWR SSC Site Assignments
After Request All DEEWR SSC Site Assignments
Resources Attributes DEEWR-esg-targetID
Policy Workflows
Type Display Name
Action DEEWR-Add site admins for an SSC
126. DEEWR-Users are updated with a removed OSC ^Top
Management Policy Rule Configuration
Name DEEWR-Users are updated with a removed OSC
Description An OSC is removed from each user which falls under the same org scope as the org(s) removed for that OSC
Created Time 18/05/2011
Type Request
Grants Permissions False
Disabled False
Requestors and Operators
Requestor All DEEWR Users
Operation Remove
Target Resources
Before Request All DEEWR OSC Org Assignments
After Request All DEEWR-esg-userRoles
Resources Attributes DEEWR-esg-targetID
Policy Workflows
Type Display Name
Action DEEWR-Remove org admins for an OSC
127. DEEWR-Users are updated with a removed SSC ^Top
Management Policy Rule Configuration
Name DEEWR-Users are updated with a removed SSC
Description An SSC is removed from each user which falls under the same site scope as the site(s) removed for that SSC
Created Time 18/05/2011
Type Request
Grants Permissions False
Disabled False
Requestors and Operators
Requestor All DEEWR Users
Operation Remove
Target Resources
Before Request All DEEWR SSC Site Assignments
After Request All DEEWR-esg-userRoles
Resources Attributes DEEWR-esg-targetID
Policy Workflows
Type Display Name
Action DEEWR-Remove site admins for an SSC
128. DEEWR-Users reset their own passwords ^Top
Management Policy Rule Configuration
Name DEEWR-Users reset their own passwords
Description Outbound policy allowing users to reset their own passwords
Created Time 7/07/2011
Type Request
Grants Permissions True
Disabled False
Requestors and Operators
Requestor ObjectID (Attribute)
Operation Modify
Target Resources
Before Request All DEEWR Users
After Request All DEEWR users with passwords being reset
Resources Attributes DEEWR-unicodePwd
Policy Workflows
Type Display Name
Action DEEWR-Reset user account password
129. Distribution list management: Owners can read attributes of group resources ^Top
Management Policy Rule Configuration
Name Distribution list management: Owners can read attributes of group resources
Description Distribution list management: Owners can read attributes of group resources
Created Time 25/10/2010
Type Request
Grants Permissions True
Disabled True
Requestors and Operators
Requestor Owner (Attribute)
Operation Read
Target Resources
Before Request All Distribution Groups
After Request All Distribution Groups
Resources Attributes CreatedTime, Description, DisplayName, ExpirationTime, Locale, ObjectID, ObjectType, AccountName, ComputedMember, DisplayedOwner, Domain, DomainConfiguration, Email, ExplicitMember, Filter, MailNickname, MembershipAddWorkflow, MembershipCondition, MembershipLocked, Owner, Scope, Type
130. Distribution list management: Owners can update and delete groups they own ^Top
Management Policy Rule Configuration
Name Distribution list management: Owners can update and delete groups they own
Description Distribution list management: Owners have elevated control over group resources
Created Time 25/10/2010
Type Request
Grants Permissions True
Disabled True
Requestors and Operators
Requestor Owner (Attribute)
Operation Modify, Delete, Add, Remove
Target Resources
Before Request All Distribution Groups
After Request All Distribution Groups
Resources Attributes Description, DisplayName, ExpirationTime, AccountName, DisplayedOwner, Email, ExplicitMember, MailNickname, MembershipAddWorkflow, ObjectSID, Owner, Scope, Type
131. Distribution list Management: Users can add or remove any members of groups subject to owner approval ^Top
Management Policy Rule Configuration
Name Distribution list Management: Users can add or remove any members of groups subject to owner approval
Description Distribution list Management: Users can add or remove any members of groups subject to owner approval
Created Time 25/10/2010
Type Request
Grants Permissions True
Disabled True
Requestors and Operators
Requestor All Active People
Operation Add, Remove
Target Resources
Before Request Owner Approved Distribution Groups
After Request Owner Approved Distribution Groups
Resources Attributes ExplicitMember
132. Distribution list management: Users can add or remove any members of groups that don't require owner approval ^Top
Management Policy Rule Configuration
Name Distribution list management: Users can add or remove any members of groups that don't require owner approval
Description Distribution list management: Users can add or remove any members of groups that don't require owner approval
Created Time 25/10/2010
Type Request
Grants Permissions True
Disabled True
Requestors and Operators
Requestor All Active People
Operation Add, Remove
Target Resources
Before Request Open Distribution Groups
After Request Open Distribution Groups
Resources Attributes ExplicitMember
133. Distribution List management: Users can create Static Distribution Groups ^Top
Management Policy Rule Configuration
Name Distribution List management: Users can create Static Distribution Groups
Description Distribution List management: Users can create Static Distribution Groups
Created Time 25/10/2010
Type Request
Grants Permissions True
Disabled True
Requestors and Operators
Requestor All Active People
Operation Create
Target Resources
Before Request All Distribution Groups
After Request Static Distribution Groups
Resources Attributes Description, DisplayName, ExpirationTime, AccountName, DisplayedOwner, Domain, DomainConfiguration, Email, ExplicitMember, MailNickname, MembershipAddWorkflow, MembershipLocked, ObjectSID, ObjectType, Owner, Scope, Type
134. Distribution list management: Users can read selected attributes of group resources ^Top
Management Policy Rule Configuration
Name Distribution list management: Users can read selected attributes of group resources
Description Distribution list management: Users can read selected attributes of group resources
Created Time 25/10/2010
Type Request
Grants Permissions True
Disabled True
Requestors and Operators
Requestor All Active People
Operation Read
Target Resources
Before Request All Distribution Groups
After Request All Distribution Groups
Resources Attributes Description, DisplayName, Locale, ObjectID, ObjectType, AccountName, ComputedMember, DisplayedOwner, Domain, DomainConfiguration, Email, ExplicitMember, MailNickname, MembershipAddWorkflow, MembershipLocked, Owner, Scope, Type
135. General workflow: Filter attribute validation for administrator ^Top
Management Policy Rule Configuration
Name General workflow: Filter attribute validation for administrator
Description General workflow: Filter attribute validation for administrator
Created Time 25/10/2010
Type Request
Grants Permissions False
Disabled False
Requestors and Operators
Requestor Administrators
Operation Create, Modify
Target Resources
Before Request All Groups and Sets
After Request All Groups and Sets
Resources Attributes Filter
Policy Workflows
Type Display Name
Authorization Filter Validation Workflow for Administrators
136. General workflow: Filter attribute validation for non-administrators ^Top
Management Policy Rule Configuration
Name General workflow: Filter attribute validation for non-administrators
Description General workflow: Filter attribute validation for non-administrators
Created Time 25/10/2010
Type Request
Grants Permissions False
Disabled False
Requestors and Operators
Requestor All Non-Administrators
Operation Create, Modify
Target Resources
Before Request All Groups and Sets
After Request All Groups and Sets
Resources Attributes Filter
Policy Workflows
Type Display Name
Authorization Filter Validation Workflow for Non-Administrators
137. General workflow: Registration initiation for authentication activity ^Top
Management Policy Rule Configuration
Name General workflow: Registration initiation for authentication activity
Description Anyone submits a request to add a value into the AuthNWFRegistered attribute triggers the registration authentication workflow
Created Time 25/10/2010
Type Request
Grants Permissions True
Disabled False
Requestors and Operators
Requestor ObjectID (Attribute)
Operation Read, Add
Target Resources
Before Request All Active People
After Request All Active People
Resources Attributes AuthNWFRegistered
Policy Workflows
Type Display Name
Authentication System Workflow Required for Registration
138. General: Users can read non-administrative configuration resources ^Top
Management Policy Rule Configuration
Name General: Users can read non-administrative configuration resources
Description General: Users can read non-administrative configuration resources
Created Time 25/10/2010
Type Request
Grants Permissions True
Disabled False
Requestors and Operators
Requestor All Active People
Operation Read
Target Resources
Before Request All Basic Configuration Objects
After Request (Attribute)
Resources Attributes All Attributes
139. General: Users can read schema related resources ^Top
Management Policy Rule Configuration
Name General: Users can read schema related resources
Description General: Users can read schema related resources
Created Time 25/10/2010
Type Request
Grants Permissions True
Disabled False
Requestors and Operators
Requestor All Active People
Operation Read
Target Resources
Before Request All Schema Objects
After Request (Attribute)
Resources Attributes All Attributes
140. Group management workflow: Group information validation for dynamic groups ^Top
Management Policy Rule Configuration
Name Group management workflow: Group information validation for dynamic groups
Description Group management workflow: Group information validation for dynamic groups
Created Time 25/10/2010
Type Request
Grants Permissions False
Disabled False
Requestors and Operators
Requestor All People
Operation Create, Add, Modify, Remove
Target Resources
Before Request All Groups
After Request All Dynamic Groups
Resources Attributes AccountName, DisplayedOwner, Domain, DomainConfiguration, Email, ExplicitMember, Filter, MembershipLocked, Scope, Type, Owner
Policy Workflows
Type Display Name
Authorization Group Validation Workflow
141. Group management workflow: Group information validation for static groups ^Top
Management Policy Rule Configuration
Name Group management workflow: Group information validation for static groups
Description Group management workflow: Group information validation for static groups
Created Time 25/10/2010
Type Request
Grants Permissions False
Disabled False
Requestors and Operators
Requestor All People
Operation Create, Add, Modify, Remove
Target Resources
Before Request All Groups
After Request All Static Groups
Resources Attributes AccountName, DisplayedOwner, Domain, DomainConfiguration, Email, Filter, MembershipLocked, Scope, Type, Owner
Policy Workflows
Type Display Name
Authorization Group Validation Workflow
142. Group management workflow: Owner approval on add member ^Top
Management Policy Rule Configuration
Name Group management workflow: Owner approval on add member
Description Group management workflow: Owner approval on add member
Created Time 25/10/2010
Type Request
Grants Permissions False
Disabled False
Requestors and Operators
Requestor All Active People
Operation Add
Target Resources
Before Request Owner Approved Groups
After Request Owner Approved Groups
Resources Attributes ExplicitMember
Policy Workflows
Type Display Name
Authorization Owner Approval Workflow
143. Group management workflow: Validate requestor on add member to open group ^Top
Management Policy Rule Configuration
Name Group management workflow: Validate requestor on add member to open group
Description Group management workflow: Validate requestor on add member to open group
Created Time 25/10/2010
Type Request
Grants Permissions False
Disabled False
Requestors and Operators
Requestor All Non-Administrators
Operation Add
Target Resources
Before Request Open Groups
After Request Open Groups
Resources Attributes ExplicitMember
Policy Workflows
Type Display Name
Authorization Requestor Validation Without Owner Authorization
144. Group management workflow: Validate requestor on remove member ^Top
Management Policy Rule Configuration
Name Group management workflow: Validate requestor on remove member
Description Group management workflow: Validate requestor on remove member
Created Time 25/10/2010
Type Request
Grants Permissions False
Disabled False
Requestors and Operators
Requestor All Non-Administrators
Operation Remove
Target Resources
Before Request All Static Groups
After Request All Static Groups
Resources Attributes ExplicitMember
Policy Workflows
Type Display Name
Authorization Requestor Validation With Owner Authorization
145. Group management: Group administrators can create and delete group resources ^Top
Management Policy Rule Configuration
Name Group management: Group administrators can create and delete group resources
Description Group management: Group administrators can create and delete group resources
Created Time 25/10/2010
Type Request
Grants Permissions True
Disabled False
Requestors and Operators
Requestor Group Administrators
Operation Create, Delete
Target Resources
Before Request All Groups
After Request All Groups
Resources Attributes Description, DisplayName, ExpirationTime, AccountName, DisplayedOwner, Domain, DomainConfiguration, Email, ExplicitMember, MailNickname, Filter, MembershipAddWorkflow, MembershipCondition, MembershipLocked, ObjectType, ObjectSID, Owner, Scope, Type
146. Group management: Group administrators can read attributes of group resources ^Top
Management Policy Rule Configuration
Name Group management: Group administrators can read attributes of group resources
Description Group management: Group administrators can read attributes of group resources
Created Time 25/10/2010
Type Request
Grants Permissions True
Disabled False
Requestors and Operators
Requestor Group Administrators
Operation Read
Target Resources
Before Request All Groups
After Request All Groups
Resources Attributes All Attributes
147. Group management: Group administrators can update group resources ^Top
Management Policy Rule Configuration
Name Group management: Group administrators can update group resources
Description Group management: Group administrators can update group resources
Created Time 25/10/2010
Type Request
Grants Permissions True
Disabled False
Requestors and Operators
Requestor Group Administrators
Operation Add, Modify, Remove
Target Resources
Before Request All Groups
After Request All Groups
Resources Attributes Description, DisplayName, ExpirationTime, AccountName, DisplayedOwner, Domain, DomainConfiguration, Email, ExplicitMember, MailNickname, Filter, MembershipAddWorkflow, MembershipCondition, MembershipLocked, ObjectSID, Owner, Scope, Type
148. Request management: Request approvers can read their approval resources ^Top
Management Policy Rule Configuration
Name Request management: Request approvers can read their approval resources
Description Request management: Request approvers can read their approval resources
Created Time 25/10/2010
Type Request
Grants Permissions True
Disabled False
Requestors and Operators
Requestor Approver (Attribute)
Operation Read
Target Resources
Before Request All Approvals
After Request All Approvals
Resources Attributes CreatedTime, Creator, MVObjectID, DeletedTime, Description, DetectedRulesList, DisplayName, ExpectedRulesList, ExpirationTime, Locale, ObjectID, ObjectType, ResourceTime, ApprovalDuration, ApprovalResponse, ApprovalStatus, ApprovalThreshold, Approver, ComputedActor, EndpointAddress, Request, Requestor, WorkflowInstance
149. Request management: Request approvers can read their approval response resources ^Top
Management Policy Rule Configuration
Name Request management: Request approvers can read their approval response resources
Description Request management: Request approvers can read their approval response resources
Created Time 25/10/2010
Type Request
Grants Permissions True
Disabled False
Requestors and Operators
Requestor Approver (Attribute)
Operation Read
Target Resources
Before Request All Approval Responses
After Request All Approval Responses
Resources Attributes CreatedTime, Creator, MVObjectID, DeletedTime, Description, DetectedRulesList, DisplayName, ExpectedRulesList, ExpirationTime, Locale, ObjectID, ObjectType, ResourceTime, Approval, ComputedActor, Decision, Reason, Requestor
150. Request management: Request creators can cancel their requests ^Top
Management Policy Rule Configuration
Name Request management: Request creators can cancel their requests
Description Request management: Request creators can cancel their requests
Created Time 25/10/2010
Type Request
Grants Permissions True
Disabled False
Requestors and Operators
Requestor Creator (Attribute)
Operation Modify
Target Resources
Before Request All Requests
After Request Requests To Be Canceled
Resources Attributes RequestControl
151. Request management: Request creators can read related approval response resources ^Top
Management Policy Rule Configuration
Name Request management: Request creators can read related approval response resources
Description Request management: Request creators can read related approval response resources
Created Time 25/10/2010
Type Request
Grants Permissions True
Disabled False
Requestors and Operators
Requestor Requestor (Attribute)
Operation Read
Target Resources
Before Request All Approval Responses
After Request (Attribute)
Resources Attributes CreatedTime, Creator, MVObjectID, DeletedTime, Description, DetectedRulesList, DisplayName, ExpectedRulesList, ExpirationTime, Locale, ObjectID, ObjectType, ResourceTime, Approval, ComputedActor, Decision, Reason, Requestor
152. Request management: Request creators can read their approval resources ^Top
Management Policy Rule Configuration
Name Request management: Request creators can read their approval resources
Description Request management: Request creators can read their approval resources
Created Time 25/10/2010
Type Request
Grants Permissions True
Disabled False
Requestors and Operators
Requestor Requestor (Attribute)
Operation Read
Target Resources
Before Request All Approvals
After Request (Attribute)
Resources Attributes CreatedTime, Creator, MVObjectID, DeletedTime, Description, DetectedRulesList, DisplayName, ExpectedRulesList, ExpirationTime, Locale, ObjectID, ObjectType, ResourceTime, ApprovalDuration, ApprovalResponse, ApprovalStatus, ApprovalThreshold, Approver, ComputedActor, EndpointAddress, Request, Requestor, WorkflowInstance
153. Request management: Request creators can read their request resource ^Top
Management Policy Rule Configuration
Name Request management: Request creators can read their request resource
Description Request management: Request creators can read their request resource
Created Time 25/10/2010
Type Request
Grants Permissions True
Disabled False
Requestors and Operators
Requestor Creator (Attribute)
Operation Read
Target Resources
Before Request All Requests
After Request (Attribute)
Resources Attributes CreatedTime, Creator, MVObjectID, DeletedTime, Description, DetectedRulesList, DisplayName, ExpectedRulesList, ExpirationTime, Locale, ObjectID, ObjectType, ResourceTime, ActionWorkflowInstance, AuthenticationWorkflowInstance, AuthorizationWorkflowInstance, HasCollateralRequest, RequestControl, CommittedTime, ComputedActor, Operation, RequestParameter, RequestStatus, RequestStatusDetail, Target, TargetObjectType
154. Request management: Request participants can read related approval resources ^Top
Management Policy Rule Configuration
Name Request management: Request participants can read related approval resources
Description Request management: Request participants can read related approval resources
Created Time 25/10/2010
Type Request
Grants Permissions True
Disabled False
Requestors and Operators
Requestor ComputedActor (Attribute)
Operation Read
Target Resources
Before Request All Approvals
After Request (Attribute)
Resources Attributes CreatedTime, Creator, MVObjectID, DeletedTime, Description, DetectedRulesList, DisplayName, ExpectedRulesList, ExpirationTime, Locale, ObjectID, ObjectType, ResourceTime, ApprovalDuration, ApprovalResponse, ApprovalStatus, ApprovalThreshold, Approver, ComputedActor, EndpointAddress, Request, Requestor, WorkflowInstance
155. Request management: Request participants can read related approval response resources ^Top
Management Policy Rule Configuration
Name Request management: Request participants can read related approval response resources
Description Request management: Request participants can read related approval response resources
Created Time 25/10/2010
Type Request
Grants Permissions True
Disabled False
Requestors and Operators
Requestor ComputedActor (Attribute)
Operation Read
Target Resources
Before Request All Approval Responses
After Request (Attribute)
Resources Attributes CreatedTime, Creator, MVObjectID, DeletedTime, Description, DetectedRulesList, DisplayName, ExpectedRulesList, ExpirationTime, Locale, ObjectID, ObjectType, ResourceTime, Approval, ComputedActor, Decision, Reason, Requestor
156. Request management: Request participants can read their request resource ^Top
Management Policy Rule Configuration
Name Request management: Request participants can read their request resource
Description Request management: Request participants can read their request resource
Created Time 25/10/2010
Type Request
Grants Permissions True
Disabled False
Requestors and Operators
Requestor ComputedActor (Attribute)
Operation Read
Target Resources
Before Request All Requests
After Request (Attribute)
Resources Attributes CreatedTime, Creator, MVObjectID, DeletedTime, Description, DetectedRulesList, DisplayName, ExpectedRulesList, ExpirationTime, Locale, ObjectID, ObjectType, ResourceTime, ActionWorkflowInstance, AuthenticationWorkflowInstance, AuthorizationWorkflowInstance, HasCollateralRequest, RequestControl, CommittedTime, ComputedActor, Operation, RequestParameter, RequestStatus, RequestStatusDetail, Target, TargetObjectType
157. Security group management: Owners can read selected attributes of group resources ^Top
Management Policy Rule Configuration
Name Security group management: Owners can read selected attributes of group resources
Description Security group management: Owners can read selected attributes of group resources
Created Time 25/10/2010
Type Request
Grants Permissions True
Disabled True
Requestors and Operators
Requestor Owner (Attribute)
Operation Read
Target Resources
Before Request All Security Groups
After Request All Security Groups
Resources Attributes CreatedTime, Creator, DeletedTime, Description, DetectedRulesList, DisplayName, ExpectedRulesList, ExpirationTime, Locale, ObjectID, ObjectType, ResourceTime, AccountName, ComputedMember, DisplayedOwner, Domain, DomainConfiguration, Email, ExplicitMember, MailNickname, Filter, MembershipAddWorkflow, MembershipCondition, MembershipLocked, ObjectSID, Owner, Scope, SIDHistory, Temporal, Type
158. Security group management: Owners can update and delete groups they own ^Top
Management Policy Rule Configuration
Name Security group management: Owners can update and delete groups they own
Description Owners have elevated control over group resources
Created Time 25/10/2010
Type Request
Grants Permissions True
Disabled True
Requestors and Operators
Requestor Owner (Attribute)
Operation Modify, Delete, Add, Remove
Target Resources
Before Request All Security Groups
After Request All Security Groups
Resources Attributes Description, DisplayName, ExpirationTime, AccountName, DisplayedOwner, Email, ExplicitMember, MailNickname, MembershipAddWorkflow, ObjectSID, Owner, Scope, Type
159. Security group management: Users can add or remove any member of groups subject to owner approval ^Top
Management Policy Rule Configuration
Name Security group management: Users can add or remove any member of groups subject to owner approval
Description Security group management: Users can add or remove any member of groups subject to owner approval
Created Time 25/10/2010
Type Request
Grants Permissions True
Disabled True
Requestors and Operators
Requestor Security Group Users
Operation Add, Remove
Target Resources
Before Request Owner Approved Security Groups
After Request Owner Approved Security Groups
Resources Attributes ExplicitMember
160. Security Group management: Users can create Static Security Groups ^Top
Management Policy Rule Configuration
Name Security Group management: Users can create Static Security Groups
Description Security Group management: Users can create Static Security Groups
Created Time 25/10/2010
Type Request
Grants Permissions True
Disabled True
Requestors and Operators
Requestor Security Group Users
Operation Create
Target Resources
Before Request All Security Groups
After Request Static Security Groups
Resources Attributes Description, DisplayName, ExpirationTime, AccountName, DisplayedOwner, Domain, DomainConfiguration, Email, ExplicitMember, MailNickname, MembershipAddWorkflow, MembershipLocked, ObjectSID, ObjectType, Owner, Scope, Type
161. Security group management: Users can read selected attributes of group resources ^Top
Management Policy Rule Configuration
Name Security group management: Users can read selected attributes of group resources
Description Security group management: Users can read selected attributes of group resources
Created Time 25/10/2010
Type Request
Grants Permissions True
Disabled True
Requestors and Operators
Requestor Security Group Users
Operation Read
Target Resources
Before Request All Security Groups
After Request All Security Groups
Resources Attributes Description, DisplayName, Locale, ObjectID, ObjectType, AccountName, Alias, ComputedMember, DisplayedOwner, Domain, DomainConfiguration, Email, ExplicitMember, MailNickname, MembershipAddWorkflow, MembershipLocked, Owner, Scope, Type
162. Security groups: Users can add and remove members to open groups ^Top
Management Policy Rule Configuration
Name Security groups: Users can add and remove members to open groups
Description Security groups: Users can add and remove members to open groups
Created Time 25/10/2010
Type Request
Grants Permissions True
Disabled True
Requestors and Operators
Requestor Security Group Users
Operation Add, Remove
Target Resources
Before Request Open Security Groups
After Request Open Security Groups
Resources Attributes ExplicitMember
163. Synchronization: Synchronization account can delete and update expected rule entry resources ^Top
Management Policy Rule Configuration
Name Synchronization: Synchronization account can delete and update expected rule entry resources
Description Permission for the synchronization account to update selected attributes of the expected rule entry resources and permission to delete them
Created Time 25/10/2010
Type Request
Grants Permissions True
Disabled False
Requestors and Operators
Requestor Synchronization Engine
Operation Modify, Delete
Target Resources
Before Request All expected rule resources
After Request All expected rule resources
Resources Attributes SynchronizationRuleStatus, StatusError
Policy Workflows
Type Display Name
Action DEEWR - Event Broker Data Changes
164. Synchronization: Synchronization account can read group resources it synchronizes ^Top
Management Policy Rule Configuration
Name Synchronization: Synchronization account can read group resources it synchronizes
Description Synchronization: Synchronization account can read group resources it synchronizes
Created Time 25/10/2010
Type Request
Grants Permissions True
Disabled True
Requestors and Operators
Requestor Synchronization Engine
Operation Read
Target Resources
Before Request All Groups
After Request All Groups
Resources Attributes All Attributes
165. Synchronization: Synchronization account can read schema related resources ^Top
Management Policy Rule Configuration
Name Synchronization: Synchronization account can read schema related resources
Description Synchronization: Synchronization account can read schema related resources
Created Time 25/10/2010
Type Request
Grants Permissions True
Disabled False
Requestors and Operators
Requestor Synchronization Engine
Operation Read
Target Resources
Before Request All Schema Objects
After Request All Schema Objects
Resources Attributes All Attributes
166. Synchronization: Synchronization account can read synchronization related resources ^Top
Management Policy Rule Configuration
Name Synchronization: Synchronization account can read synchronization related resources
Description Synchronization: Synchronization account can read synchronization related resources
Created Time 25/10/2010
Type Request
Grants Permissions True
Disabled False
Requestors and Operators
Requestor Synchronization Engine
Operation Read
Target Resources
Before Request All Synchronization Related Resources
After Request (Attribute)
Resources Attributes All Attributes
167. Synchronization: Synchronization account can read users it synchronizes ^Top
Management Policy Rule Configuration
Name Synchronization: Synchronization account can read users it synchronizes
Description Synchronization: Synchronization account can read users it synchronizes
Created Time 25/10/2010
Type Request
Grants Permissions True
Disabled False
Requestors and Operators
Requestor Synchronization Engine
Operation Read
Target Resources
Before Request All People
After Request All People
Resources Attributes All Attributes
168. Synchronization: Synchronization account controls detected rule entry resources ^Top
Management Policy Rule Configuration
Name Synchronization: Synchronization account controls detected rule entry resources
Description Synchronization: Synchronization account controls detected rule entry resources
Created Time 25/10/2010
Type Request
Grants Permissions True
Disabled False
Requestors and Operators
Requestor Synchronization Engine
Operation Create, Delete, Modify
Target Resources
Before Request All Detected Rule Resources
After Request All Detected Rule Resources
Resources Attributes Description, DisplayName, Connector, MVObjectID, ObjectType, ResourceParent, SynchronizationRuleID
169. Synchronization: Synchronization account controls group resources it synchronizes ^Top
Management Policy Rule Configuration
Name Synchronization: Synchronization account controls group resources it synchronizes
Description Synchronization: Synchronization account controls group resources it synchronizes
Created Time 25/10/2010
Type Request
Grants Permissions True
Disabled True
Requestors and Operators
Requestor Synchronization Engine
Operation Create, Delete, Add, Modify, Remove
Target Resources
Before Request All Groups
After Request All Groups
Resources Attributes DetectedRulesList, Description, DisplayName, ExpectedRulesList, ExpirationTime, MVObjectID, AccountName, ComputedMember, DisplayedOwner, Domain, DomainConfiguration, Email, ExplicitMember, MailNickname, Filter, MembershipAddWorkflow, MembershipCondition, MembershipLocked, ObjectType, ObjectSID, Owner, Scope, SIDHistory, Temporal, Type
170. Synchronization: Synchronization account controls synchronization configuration resources ^Top
Management Policy Rule Configuration
Name Synchronization: Synchronization account controls synchronization configuration resources
Description Synchronization: Synchronization account controls synchronization configuration resources
Created Time 25/10/2010
Type Request
Grants Permissions True
Disabled False
Requestors and Operators
Requestor Synchronization Engine
Operation Create, Delete, Add, Modify, Remove
Target Resources
Before Request All ma-data and mv-data Resources
After Request All ma-data and mv-data Resources
Resources Attributes MVObjectID, Description, DisplayName, ExpirationTime, ObjectType, SyncConfig-category, SyncConfig-id, SyncConfig-sub-type, SyncConfig-ma-listname, SyncConfig-ma-companyname, SyncConfig-creation-time, SyncConfig-last-modification-time, SyncConfig-version, SyncConfig-format-version, SyncConfig-internal-version, SyncConfig-schema, SyncConfig-attribute-inclusion, SyncConfig-stay-disconnector, SyncConfig-join, SyncConfig-projection, SyncConfig-export-attribute-flow, SyncConfig-provisioning-cleanup, SyncConfig-provisioning-cleanup-type, SyncConfig-extension, SyncConfig-controller-configuration, SyncConfig-password-sync-allowed, SyncConfig-ma-ui-settings, SyncConfig-private-configuration, SyncConfig-encrypted-attributes, SyncConfig-ma-partition-data, SyncConfig-ma-run-data, SyncConfig-capabilities-mask, SyncConfig-export-type, SyncConfig-dn-construction, SyncConfig-password-sync, SyncConfig-component_mappings, SyncConfig-refresh-schema, SyncConfig-import-attribute-flow, SyncConfig-mv-deletion, SyncConfig-provisioning, SyncConfig-provisioning-type, SyncConfig-password-change-history-size
171. Synchronization: Synchronization account controls users it synchronizes ^Top
Management Policy Rule Configuration
Name Synchronization: Synchronization account controls users it synchronizes
Description Synchronization: Synchronization account controls users it synchronizes
Created Time 25/10/2010
Type Request
Grants Permissions True
Disabled False
Requestors and Operators
Requestor Synchronization Engine
Operation Create, Delete, Add, Modify, Remove
Target Resources
Before Request All People
After Request All People
Resources Attributes Description, DisplayName, ExpirationTime, AccountName, AD_UserCannotChangePassword, Address, Assistant, City, AuthNWFLockedOut, AuthNLockoutRegistrationID, AuthNWFRegistered, Company, CostCenter, CostCenterName, Country, Department, Domain, DomainConfiguration, Email, EmployeeEndDate, EmployeeID, EmployeeStartDate, EmployeeType, FirstName, FreezeCount, FreezeLevel, IsRASEnabled, JobTitle, LastName, LastResetAttemptTime, LoginName, MailNickname, Manager, MiddleName, MobilePhone, ObjectType, ObjectSID, OfficeFax, OfficeLocation, OfficePhone, Register, ResetPassword, Photo, PostalCode, ProxyAddressCollection, RegistrationRequired, SIDHistory, DetectedRulesList, ExpectedRulesList, MVObjectID, TimeZone, DEEWR-employmentAUExtIAMAdminRoles, DEEWR-employmentAUExtInquisitionStatus, DEEWR-employmentAUExtOrgCode, DEEWR-employmentAUExtSecurityRole1, DEEWR-employmentAUExtSecurityRole2, DEEWR-employmentAUExtSecurityRole4, DEEWR-employmentAUExtSite, DEEWR-employmentAUIntIMUserOrgDN, lastLogon, whenCreated
172. Temporal policy workflow: Impending group resource expiry notification ^Top
Management Policy Rule Configuration
Name Temporal policy workflow: Impending group resource expiry notification
Description Temporal policy workflow: Impending group resource expiry notification
Created Time 25/10/2010
Type Set Transition
Grants Permissions False
Disabled False
Transition Definition
Transition Type Transition In
Transition Set Expiring Group Resources
Policy Workflows
Type Display Name
Action Group Expiration Notification Workflow
173. User management: Users can read attributes of their own ^Top
Management Policy Rule Configuration
Name User management: Users can read attributes of their own
Description User management: Users can read attributes of their own
Created Time 25/10/2010
Type Request
Grants Permissions True
Disabled False
Requestors and Operators
Requestor ObjectID (Attribute)
Operation Read
Target Resources
Before Request All Active People
After Request (Attribute)
Resources Attributes DetectedRulesList, DisplayName, ExpectedRulesList, Locale, ObjectID, ObjectType, AccountName, Address, City, Company, CostCenter, CostCenterName, Country, Department, Domain, DomainConfiguration, Email, FirstName, JobTitle, LastName, MailNickname, MiddleName, MobilePhone, OfficeFax, OfficeLocation, OfficePhone, PostalCode, ProxyAddressCollection, TimeZone, DEEWR-esg-roleID
174. User management: Users can read selected attributes of other users ^Top
Management Policy Rule Configuration
Name User management: Users can read selected attributes of other users
Description User management: Users can read selected attributes of other Users
Created Time 25/10/2010
Type Request
Grants Permissions True
Disabled True
Requestors and Operators
Requestor All Active People
Operation Read
Target Resources
Before Request All People
After Request (Attribute)
Resources Attributes DisplayName, ObjectID, ObjectType, AccountName, Address, City, Company, CostCenter, CostCenterName, Country, Department, Domain, DomainConfiguration, Email, FirstName, JobTitle, LastName, MailNickname, Manager, MiddleName, MobilePhone, TimeZone
175. User management: Users can update attributes of their own ^Top
Management Policy Rule Configuration
Name User management: Users can update attributes of their own
Description User management: Users can update attributes of their own
Created Time 14/04/2011
Type Request
Grants Permissions True
Disabled True
Requestors and Operators
Requestor ObjectID (Attribute)
Operation Modify
Target Resources
Before Request All Active People
After Request All Active People
Resources Attributes FirstName, LastName, MiddleName, MobilePhone, OfficeFax, OfficePhone
176. Users Management: Developers can read and update DEEWR-apps ^Top
Management Policy Rule Configuration
Name Users Management: Developers can read and update DEEWR-apps
Description Users Management: Developers can read and update DEEWR-apps
Created Time 14/04/2011
Type Request
Grants Permissions True
Disabled False
Requestors and Operators
Requestor All DEEWR Developers
Operation Add, Create, Delete, Modify, Read, Remove
Target Resources
Before Request All DEEWR-apps
After Request All DEEWR-apps
Resources Attributes All Attributes
177. Users Management: Developers can read and update DEEWR-claimTypes ^Top
Management Policy Rule Configuration
Name Users Management: Developers can read and update DEEWR-claimTypes
Description Users Management: Developers can read and update DEEWR-claimTypes
Created Time 14/04/2011
Type Request
Grants Permissions True
Disabled False
Requestors and Operators
Requestor All DEEWR Developers
Operation Add, Create, Delete, Modify, Read, Remove
Target Resources
Before Request All DEEWR-claimTypes
After Request All DEEWR-claimTypes
Resources Attributes All Attributes
178. Users Management: Developers can read and update DEEWR-esg-contracts ^Top
Management Policy Rule Configuration
Name Users Management: Developers can read and update DEEWR-esg-contracts
Description Users Management: Developers can read and update DEEWR-esg-contracts
Created Time 14/04/2011
Type Request
Grants Permissions True
Disabled False
Requestors and Operators
Requestor All DEEWR Developers
Operation Add, Create, Delete, Modify, Read, Remove
Target Resources
Before Request All DEEWR-esg-contracts
After Request All DEEWR-esg-contracts
Resources Attributes All Attributes
Policy Workflows
Type Display Name
Action DEEWR - Event Broker Data Changes
179. Users Management: Developers can read and update DEEWR-esg-orgs ^Top
Management Policy Rule Configuration
Name Users Management: Developers can read and update DEEWR-esg-orgs
Description Users Management: Developers can read and update DEEWR-esg-orgs
Created Time 14/04/2011
Type Request
Grants Permissions True
Disabled False
Requestors and Operators
Requestor All DEEWR Developers
Operation Add, Create, Delete, Modify, Read, Remove
Target Resources
Before Request All DEEWR-esg-orgs
After Request All DEEWR-esg-orgs
Resources Attributes All Attributes
Policy Workflows
Type Display Name
Action DEEWR - Event Broker Data Changes
180. Users Management: Developers can read and update DEEWR-esg-sites ^Top
Management Policy Rule Configuration
Name Users Management: Developers can read and update DEEWR-esg-sites
Description Users Management: Developers can read and update DEEWR-esg-sites
Created Time 14/04/2011
Type Request
Grants Permissions True
Disabled False
Requestors and Operators
Requestor All DEEWR Developers
Operation Add, Create, Delete, Modify, Read, Remove
Target Resources
Before Request All DEEWR-esg-sites
After Request All DEEWR-esg-sites
Resources Attributes All Attributes
Policy Workflows
Type Display Name
Action DEEWR - Event Broker Data Changes
1. All DEEWR ESS OSC or SEC users ^Top
ObjectID All DEEWR ESS OSC or SEC users
CreatedTime 9/06/2011 12:06:42
Description All DEEWR ESS OSC or SEC users
DisplayName All DEEWR ESS OSC or SEC users
Filter /Person[(ObjectID = /Set[ObjectID = '1ea1bfab-4e4b-4f26-8bd8-dacb52fdeb82']/ComputedMember) or (ObjectID = /Set[ObjectID = 'd1263f6e-dc20-44fd-9f71-c7a9fd783b91']/ComputedMember)]
ObjectType Set
Temporal False
2. All DEEWR-esg-roleTemplates ^Top
ObjectID All DEEWR-esg-roleTemplates
CreatedTime 5/05/2011 4:52:17
Description All user templates defining default role membership
DisplayName All DEEWR-esg-roleTemplates
Filter /DEEWR-esg-roleTemplate
ObjectType Set
Temporal False
3. Administrators ^Top
ObjectID Administrators
CreatedTime 25/10/2010 14:39:22
DisplayName Administrators
ExplicitMember *** various ***
ObjectType Set
4. All Non-System Attribute Definitions ^Top
ObjectID All Non-System Attribute Definitions
CreatedTime 25/10/2010 14:39:22
DisplayName All Non-System Attribute Definitions
Filter /AttributeTypeDescription[not (UsageKeyword ='Microsoft.ResourceManagement.WebServices') and not (UsageKeyword='Microsoft.ResourceManagement.PasswordReset') and not(UsageKeyword='Microsoft.ResourceManagement.PortalClient') and not(UsageKeyword='Microsoft.ResourceManagement.OfficeIntegration')]
ObjectType Set
5. All Non-System Binding Descriptions ^Top
ObjectID All Non-System Binding Descriptions
CreatedTime 25/10/2010 14:39:22
DisplayName All Non-System Binding Descriptions
Filter /BindingDescription[not (UsageKeyword ='Microsoft.ResourceManagement.WebServices') and not(UsageKeyword='Microsoft.ResourceManagement.PasswordReset') and not (UsageKeyword='Microsoft.ResourceManagement.PortalClient') and not(UsageKeyword='Microsoft.ResourceManagement.OfficeIntegration')]
ObjectType Set
6. All Non-System Schema Objects ^Top
ObjectID All Non-System Schema Objects
CreatedTime 25/10/2010 14:39:22
DisplayName All Non-System Schema Objects
Filter /*[(ObjectID = /Set[ObjectID = 'a0a1e2ee-5f8a-47bb-91ea-88b48f6b5ece']/ComputedMember) or (ObjectID = /Set[ObjectID = '58609b35-3d92-4a0a-b264-752e2a1ba110']/ComputedMember) or (ObjectID = /Set[ObjectID = 'e303c241-1b5c-47ed-9523-52c0b247e192']/ComputedMember)]
ObjectType Set
Temporal False
7. All Schema Objects ^Top
ObjectID All Schema Objects
CreatedTime 25/10/2010 14:39:22
DisplayName All Schema Objects
Filter /*[ObjectType='AttributeTypeDescription' or ObjectType='BindingDescription' or ObjectType='ConstantSpecifier' or ObjectType='ObjectTypeDescription']
ObjectType Set
8. All Attribute Definitions ^Top
ObjectID All Attribute Definitions
CreatedTime 25/10/2010 14:39:22
DisplayName All Attribute Definitions
Filter /AttributeTypeDescription
ObjectType Set
9. All Bindings ^Top
ObjectID All Bindings
CreatedTime 25/10/2010 14:39:22
DisplayName All Bindings
Filter /BindingDescription
ObjectType Set
10. All Object Type Definitions ^Top
ObjectID All Object Type Definitions
CreatedTime 25/10/2010 14:39:22
DisplayName All Object Type Definitions
Filter /ObjectTypeDescription
ObjectType Set
11. All Requests ^Top
ObjectID All Requests
CreatedTime 25/10/2010 14:39:22
DisplayName All Requests
Filter /Request
ObjectType Set
12. All ma-data and mv-data Resources ^Top
ObjectID All ma-data and mv-data Resources
CreatedTime 25/10/2010 14:39:22
DisplayName All ma-data and mv-data Resources
Filter /*[ObjectType='ma-data' or ObjectType='mv-data']
ObjectType Set
13. All Non-Administrators ^Top
ObjectID All Non-Administrators
CreatedTime 25/10/2010 14:39:22
DisplayName All Non-Administrators
Filter /Person[ObjectID != /Set[ObjectID = '10000005-1111-45b5-ad13-2764d866c000']/ComputedMember]
ObjectType Set
14. All Objects ^Top
ObjectID All Objects
CreatedTime 25/10/2010 14:39:22
DisplayName All Objects
Filter /*
ObjectType Set
15. All People ^Top
ObjectID All People
CreatedTime 25/10/2010 14:39:22
DisplayName All People
Filter /Person
ObjectType Set
16. All Synchronization Filter Definition Resources ^Top
ObjectID All Synchronization Filter Definition Resources
CreatedTime 25/10/2010 14:39:22
DisplayName All Synchronization Filter Definition Resources
Filter /SynchronizationFilter
ObjectType Set
17. All Configuration Resources ^Top
ObjectID All Configuration Resources
CreatedTime 25/10/2010 14:39:22
DisplayName All Configuration Resources
Filter /*[ObjectType='ActivityInformationConfiguration' or ObjectType='SupportedLocaleConfiguration' or ObjectType='ConstantSpecifier' or ObjectType='DomainConfiguration' or ObjectType='EmailTemplate' or ObjectType='ForestConfiguration' or ObjectType='HomepageConfiguration' or ObjectType='NavigationBarConfiguration' or ObjectType='ObjectVisualizationConfiguration' or ObjectType='PortalUIConfiguration' or ObjectType='SearchScopeConfiguration' or ObjectType='TimeZoneConfiguration']
ObjectType Set
18. All Management Policy Rules ^Top
ObjectID All Management Policy Rules
CreatedTime 25/10/2010 14:39:22
DisplayName All Management Policy Rules
Filter /ManagementPolicyRule
ObjectType Set
19. All Sets ^Top
ObjectID All Sets
CreatedTime 25/10/2010 14:39:22
DisplayName All Sets
Filter /Set
ObjectType Set
20. All Synchronization Rule Resources ^Top
ObjectID All Synchronization Rule Resources
CreatedTime 25/10/2010 14:39:22
DisplayName All Synchronization Rule Resources
Filter /SynchronizationRule
ObjectType Set
21. All Workflows ^Top
ObjectID All Workflows
CreatedTime 25/10/2010 14:39:22
DisplayName All Workflows
Filter /WorkflowDefinition
ObjectType Set
22. All FilterScope Resources ^Top
ObjectID All FilterScope Resources
CreatedTime 25/10/2010 14:39:22
DisplayName All FilterScope Resources
Filter /FilterScope
ObjectType Set
23. All Button Viewable Sets ^Top
ObjectID All Button Viewable Sets
CreatedTime 25/10/2010 14:39:22
DisplayName All Button Viewable Sets
ExplicitMember *** various ***
ObjectType Set
24. All Activity Information Configurations ^Top
ObjectID All Activity Information Configurations
CreatedTime 25/10/2010 14:39:22
DisplayName All Activity Information Configurations
Filter /ActivityInformationConfiguration
ObjectType Set
25. All DEEWR ESS SD3 and OSC users ^Top
ObjectID All DEEWR ESS SD3 and OSC users
CreatedTime 8/06/2011 7:49:13
Description All DEEWR ESS SD3 and OSC users
DisplayName All DEEWR ESS SD3 and OSC users
Filter /Person[(ObjectID = /Set[ObjectID = '3f8772af-adb6-4964-be86-1a5065a032ef']/ComputedMember) or (ObjectID = /Set[ObjectID = '1ea1bfab-4e4b-4f26-8bd8-dacb52fdeb82']/ComputedMember)]
ObjectType Set
Temporal False
26. All DEEWR-esg-invitations ^Top
ObjectID All DEEWR-esg-invitations
CreatedTime 13/05/2011 4:18:00
Description All DEEWR ESG invitations for a person to join an org or site
DisplayName All DEEWR-esg-invitations
Filter /DEEWR-esg-invitation
ObjectType Set
Temporal False
27. All DEEWR-esg-invitations accepted ^Top
ObjectID All DEEWR-esg-invitations accepted
CreatedTime 16/05/2011 8:49:21
Description All DEEWR invitations marked as accepted and ready for applying to user entitlements
DisplayName All DEEWR-esg-invitations accepted
Filter /DEEWR-esg-invitation[(DEEWR-userID = /Set[ObjectID = '8887df8e-6e84-49f2-a794-f9e9802077e0']/ComputedMember) and (DEEWR-esg-isAccepted = True)]
ObjectType Set
Temporal False
28. All DEEWR-esg-contracts ^Top
ObjectID All DEEWR-esg-contracts
CreatedTime 23/02/2011 4:58:20
Description All DEEWR-esg-contracts
DisplayName All DEEWR-esg-contracts
Filter /DEEWR-esg-contract
ObjectType Set
Temporal False
29. All DEEWR-esg-orgs ^Top
ObjectID All DEEWR-esg-orgs
CreatedTime 23/02/2011 4:57:12
Description All DEEWR-esg-orgs
DisplayName All DEEWR-esg-orgs
Filter /DEEWR-esg-org
ObjectType Set
Temporal False
30. All DEEWR-esg-roles ^Top
ObjectID All DEEWR-esg-roles
CreatedTime 11/04/2011 6:01:07
Description All DEEWR-esg-roles
DisplayName All DEEWR-esg-roles
Filter /DEEWR-esg-role
ObjectType Set
Temporal False
31. All DEEWR-esg-sites ^Top
ObjectID All DEEWR-esg-sites
CreatedTime 23/02/2011 4:57:44
Description All DEEWR-esg-sites
DisplayName All DEEWR-esg-sites
Filter /DEEWR-esg-site
ObjectType Set
Temporal False
32. All DEEWR-esg-userRoles ^Top
ObjectID All DEEWR-esg-userRoles
CreatedTime 30/05/2011 9:42:25
Description All DEEWR-esg-userRoles
DisplayName All DEEWR-esg-userRoles
Filter /DEEWR-esg-userRole
ObjectType Set
Temporal False
33. All DEEWR sub keys ^Top
ObjectID All DEEWR sub keys
CreatedTime 27/06/2011 9:11:55
Description All sub keys
DisplayName All DEEWR sub keys
Filter /DEEWR-subKey
ObjectType Set
Temporal False
34. All DEEWR-vasco-DPTokens ^Top
ObjectID All DEEWR-vasco-DPTokens
CreatedTime 23/05/2011 7:40:44
Description All DEEWR-vasco-DPTokens
DisplayName All DEEWR-vasco-DPTokens
Filter /DEEWR-vasco-DPToken
ObjectType Set
Temporal False
35. All DEEWR-roles ^Top
ObjectID All DEEWR-roles
CreatedTime 11/05/2011 6:40:24
Description All DEEWR-roles
DisplayName All DEEWR-roles
Filter /DEEWR-role
ObjectType Set
Temporal False
36. All DEEWR Claims ^Top
ObjectID All DEEWR Claims
CreatedTime 9/03/2011 4:30:22
Description All DEEWR Claims
DisplayName All DEEWR Claims
Filter /DEEWR-claim
ObjectType Set
Temporal False
37. All DEEWR-claimTypes ^Top
ObjectID All DEEWR-claimTypes
CreatedTime 9/03/2011 4:29:55
Description All DEEWR Claim Types
DisplayName All DEEWR-claimTypes
Filter /DEEWR-claimType
ObjectType Set
Temporal False
38. All DEEWR-dept ^Top
ObjectID All DEEWR-dept
CreatedTime 13/04/2011 4:42:34
Description All DEEWR-dept
DisplayName All DEEWR-dept
Filter /DEEWR-Dept
ObjectType Set
Temporal False
39. All DEEWR Users ^Top
ObjectID All DEEWR Users
CreatedTime 13/04/2011 5:55:03
Description All DEEWR Users
DisplayName All DEEWR Users
Filter /Person
ObjectType Set
Temporal False
40. All DEEWR ESS Admins ^Top
ObjectID All DEEWR ESS Admins
CreatedTime 8/07/2011 0:30:25
Description All DEEWR ESS Admins
DisplayName All DEEWR ESS Admins
Filter /Person[ObjectID = /Set[ObjectID = '582af6d0-1aa5-421e-a1d0-7b9fe3225350']/ComputedMember]
ObjectType Set
Temporal False
41. All DEEWR-apps ^Top
ObjectID All DEEWR-apps
CreatedTime 9/03/2011 4:29:14
Description All DEEWR-apps
DisplayName All DEEWR-apps
Filter /DEEWR-App
ObjectType Set
Temporal False
42. All DEEWR ESS SEC, SD3, SD1, EPS, OSC, ACM and SSC users ^Top
ObjectID All DEEWR ESS SEC, SD3, SD1, EPS, OSC, ACM and SSC users
CreatedTime 8/06/2011 8:01:13
Description All DEEWR ESS SEC, SD3, SD1, EPS, OSC, ACM and SSC users
DisplayName All DEEWR ESS SEC, SD3, SD1, EPS, OSC, ACM and SSC users
Filter /Person[(ObjectID = /Set[ObjectID = 'd1263f6e-dc20-44fd-9f71-c7a9fd783b91']/ComputedMember) or (ObjectID = /Set[ObjectID = '3f8772af-adb6-4964-be86-1a5065a032ef']/ComputedMember) or (ObjectID = /Set[ObjectID = '76a8fc18-8141-4e45-a0b3-8fcc719af7bf']/ComputedMember) or (ObjectID = /Set[ObjectID = 'e977b994-ff0a-4ff7-84e2-19412aef2b5c']/ComputedMember) or (ObjectID = /Set[ObjectID = '1ea1bfab-4e4b-4f26-8bd8-dacb52fdeb82']/ComputedMember) or (ObjectID = /Set[ObjectID = 'ae00c10c-674d-4b43-bda4-136f1c8b27e5']/ComputedMember) or (ObjectID = /Set[ObjectID = 'bb1746cf-9441-48a6-a267-d35540506f6e']/ComputedMember)]
ObjectType Set
Temporal False
43. All DEEWR ESS SD3 users ^Top
ObjectID All DEEWR ESS SD3 users
CreatedTime 8/06/2011 7:35:29
Description All DEEWR ESS SD3 users
DisplayName All DEEWR ESS SD3 users
Filter /Person[DEEWR-roleID = '55d79fdc-eb15-49d1-9238-ed072b3c0b8f']
ObjectType Set
Temporal False
44. All DEEWR ESS SEC and SD3 users ^Top
ObjectID All DEEWR ESS SEC and SD3 users
CreatedTime 8/06/2011 8:15:46
Description All DEEWR ESS SEC and SD3 users
DisplayName All DEEWR ESS SEC and SD3 users
Filter /Person[(ObjectID = /Set[ObjectID = 'd1263f6e-dc20-44fd-9f71-c7a9fd783b91']/ComputedMember) or (ObjectID = /Set[ObjectID = '3f8772af-adb6-4964-be86-1a5065a032ef']/ComputedMember)]
ObjectType Set
Temporal False
45. All DEEWR ESS OSCs ^Top
ObjectID All DEEWR ESS OSCs
CreatedTime 19/04/2011 6:07:38
Description All DEEWR ESS OSCs
DisplayName All DEEWR ESS OSCs
Filter /Person[DEEWR-roleID = 'a4542174-d09f-4a6d-811e-9ceaa620b9c6']
ObjectType Set
Temporal False
46. All DEEWR ESS SSCs ^Top
ObjectID All DEEWR ESS SSCs
CreatedTime 19/04/2011 6:08:31
Description All DEEWR ESS SSCs
DisplayName All DEEWR ESS SSCs
Filter /Person[DEEWR-roleID = '8965fc59-34ec-44b4-be53-84f26190189d']
ObjectType Set
Temporal False
47. ALL DEEWR ESS SEC or OSC or SSC users ^Top
ObjectID ALL DEEWR ESS SEC or OSC or SSC users
CreatedTime 10/06/2011 2:37:14
Description ALL DEEWR ESS SEC or OSC or SSC users
DisplayName ALL DEEWR ESS SEC or OSC or SSC users
Filter /Person[(ObjectID = /Set[ObjectID = 'd1263f6e-dc20-44fd-9f71-c7a9fd783b91']/ComputedMember) or (ObjectID = /Set[ObjectID = '1ea1bfab-4e4b-4f26-8bd8-dacb52fdeb82']/ComputedMember) or (ObjectID = /Set[ObjectID = 'ae00c10c-674d-4b43-bda4-136f1c8b27e5']/ComputedMember)]
ObjectType Set
Temporal False
48. All DEEWR invalid claims to be deleted ^Top
ObjectID All DEEWR invalid claims to be deleted
CreatedTime 28/06/2011 7:17:24
Description Claims that no longer have valid references and must be deleted (catch all)
DisplayName All DEEWR invalid claims to be deleted
Filter /DEEWR-claim[(DEEWR-applicationID != /Set[ObjectID = '31a3f39f-852e-4b3c-bd2e-1588b4b63d9f']/ComputedMember) or (DEEWR-subKeyID != /Set[ObjectID = '7c866fd3-cf65-46cf-a198-4ea2f84980ec']/ComputedMember) or not(DEEWR-claimTypeID = /Set[ObjectID = '7c866fd3-cf65-46cf-a198-4ea2f84980ec']/ComputedMember) or not(DEEWR-claimValueID = /Set[ObjectID = '7c866fd3-cf65-46cf-a198-4ea2f84980ec']/ComputedMember) or (DEEWR-userID != /Set[ObjectID = 'fa544715-53eb-496c-a8b5-765196829e67']/ComputedMember)]
ObjectType Set
Temporal False
49. All DEEWR Claims with invalid values ^Top
ObjectID All DEEWR Claims with invalid values
CreatedTime 30/06/2011 9:07:15
Description All claims with invalid values
DisplayName All DEEWR Claims with invalid values
Filter /DEEWR-claim[not(DEEWR-claimValueID=/Set[ObjectID='7c866fd3-cf65-46cf-a198-4ea2f84980ec']/ComputedMember)]
ObjectType Set
Temporal False
50. All empty DEEWR user role assignments ^Top
ObjectID All empty DEEWR user role assignments
CreatedTime 31/05/2011 9:28:43
Description All user role assignments that no longer have targets
DisplayName All empty DEEWR user role assignments
Filter /DEEWR-esg-userRole[not(DEEWR-esg-targetID = /Set[ObjectID='7c866fd3-cf65-46cf-a198-4ea2f84980ec']/ComputedMember) and (DEEWR-assignedRoleID='a4542174-d09f-4a6d-811e-9ceaa620b9c6' and not(DEEWR-userID=/Set[ObjectID='1ea1bfab-4e4b-4f26-8bd8-dacb52fdeb82']/ComputedMember)) or (DEEWR-assignedRoleID='8965fc59-34ec-44b4-be53-84f26190189d' and not(DEEWR-userID=/Set[ObjectID='ae00c10c-674d-4b43-bda4-136f1c8b27e5']/ComputedMember))]
ObjectType Set
Temporal False
51. DEEWR-Forefront Identity Manager Service Account ^Top
ObjectID DEEWR-Forefront Identity Manager Service Account
CreatedTime 20/04/2011 7:56:42
Description Forefront Identity Manager Service Account resource
DisplayName DEEWR-Forefront Identity Manager Service Account
Filter /*[DisplayName = 'Forefront Identity Manager Service Account']
ObjectType Set
Temporal False
52. All DEEWR-esg-claims with valid references ^Top
ObjectID All DEEWR-esg-claims with valid references
CreatedTime 19/04/2011 7:10:46
Description All claim objects with reference values set for each of claim type, application and user
DisplayName All DEEWR-esg-claims with valid references
Filter /DEEWR-claim[(ObjectID = /Set[ObjectID='6c9a0954-1d70-4b79-a6a1-817c1d109627']/ComputedMember) and (DEEWR-applicationID = /Set[ObjectID = '31a3f39f-852e-4b3c-bd2e-1588b4b63d9f']/ComputedMember) and (DEEWR-userID = /Set[ObjectID = '8887df8e-6e84-49f2-a794-f9e9802077e0']/ComputedMember) and (DEEWR-claimTypeID = /Set[ObjectID='8fb496ba-6630-4364-b5d3-6f7564f2a112']/ComputedMember) and (DEEWR-claimValueID = /Set[ObjectID='7c866fd3-cf65-46cf-a198-4ea2f84980ec']/ComputedMember)]
ObjectType Set
Temporal False
53. All DEEWR claim administrators and FIM services ^Top
ObjectID All DEEWR claim administrators and FIM services
CreatedTime 12/05/2011 3:28:04
Description All DEEWR claim administrators and FIM services
DisplayName All DEEWR claim administrators and FIM services
ExplicitMember *** various ***
Filter /*[(ObjectID = /Set[ObjectID = 'c36c52f5-7060-4e3f-bc3e-b9e568d82fec']/ComputedMember) or (ObjectID = 'fb89aefa-5ea1-47f1-8890-abe7797d6497')]
ObjectType Set
Temporal False
54. ALL DEEWR Users with valid ADMIN ROLE claims ^Top
ObjectID ALL DEEWR Users with valid ADMIN ROLE claims
CreatedTime 2/06/2011 5:00:56
Description Users eligible for ADMIN ROLE claims
DisplayName ALL DEEWR Users with valid ADMIN ROLE claims
Filter /Person[(ObjectID = /Set[ObjectID = 'bc6220f6-22fa-421a-af6a-ae238fbc99f7']/ComputedMember) and (ObjectID = /Set[ObjectID = 'a79d5239-f204-470e-889c-a4cb52bf986e']/ComputedMember) and (not(DisplayName = '#Invalid#')) and (ObjectID = /Set[ObjectID = 'ef062b32-9108-41e2-ae04-1f785db302df']/ComputedMember)]
ObjectType Set
Temporal False
55. All DEEWR users WITH valid ADMIN ROLEs ^Top
ObjectID All DEEWR users WITH valid ADMIN ROLEs
CreatedTime 1/06/2011 2:14:02
Description All DEEWR users for which ADMIN ROLE CLAIMS claims are applicable
DisplayName All DEEWR users WITH valid ADMIN ROLEs
Filter /Person[DEEWR-roleID = /Set[ObjectID='7c866fd3-cf65-46cf-a198-4ea2f84980ec']/ComputedMember]
ObjectType Set
Temporal False
56. All DEEWR users WITHOUT valid ADMIN ROLEs ^Top
ObjectID All DEEWR users WITHOUT valid ADMIN ROLEs
CreatedTime 30/06/2011 9:37:00
Description All users WITHOUT valid ADMIN ROLEs
DisplayName All DEEWR users WITHOUT valid ADMIN ROLEs
Filter /Person[not(DEEWR-roleID = /Set[ObjectID='7c866fd3-cf65-46cf-a198-4ea2f84980ec']/ComputedMember)]
ObjectType Set
Temporal False
57. ALL DEEWR Users with valid ORG claims ^Top
ObjectID ALL DEEWR Users with valid ORG claims
CreatedTime 2/06/2011 5:15:27
Description Users which are eligible for ORG claims
DisplayName ALL DEEWR Users with valid ORG claims
Filter /Person[(ObjectID = /Set[ObjectID = 'bc6220f6-22fa-421a-af6a-ae238fbc99f7']/ComputedMember) and (not(DisplayName = '%Invalid%')) and (ObjectID = /Set[ObjectID = 'ef062b32-9108-41e2-ae04-1f785db302df']/ComputedMember)]
ObjectType Set
Temporal False
58. ALL DEEWR Users with valid ROLE claims ^Top
ObjectID ALL DEEWR Users with valid ROLE claims
CreatedTime 2/06/2011 4:59:26
Description Users eligible for ROLE claims
DisplayName ALL DEEWR Users with valid ROLE claims
Filter /Person[(ObjectID = /Set[ObjectID = '3a34fd86-8605-4cc0-ab8d-cddabe4aa8ab']/ComputedMember) and (ObjectID = /Set[ObjectID = 'e0cb4b00-86bc-4070-be3d-7af3b4657743']/ComputedMember)]
ObjectType Set
Temporal False
59. All DEEWR Users with valid SITE claims ^Top
ObjectID All DEEWR Users with valid SITE claims
CreatedTime 2/06/2011 4:56:05
Description Users eligible for SITE claims
DisplayName All DEEWR Users with valid SITE claims
Filter /Person[(ObjectID = /Set[ObjectID = 'a359d2b1-f8d8-47b2-8987-8dcd6c27386a']/ComputedMember) and (ObjectID = /Set[ObjectID = 'e48b0270-0205-4d48-8d6c-7c70ee580367']/ComputedMember)]
ObjectType Set
Temporal False
60. All DEEWR Claim administrators ^Top
ObjectID All DEEWR Claim administrators
CreatedTime 20/04/2011 8:25:57
Description All DEEWR Claims administrators
DisplayName All DEEWR Claim administrators
Filter /*[(ObjectID = /Set[ObjectID = 'b419d131-a7b2-4a88-b066-e2684900d644']/ComputedMember) and (ObjectID = /Set[ObjectID = '004df053-a993-4502-aa9a-aaf8111c96f4']/ComputedMember)]
ObjectType Set
Temporal False
61. Synchronization Engine ^Top
ObjectID Synchronization Engine
CreatedTime 25/10/2010 14:39:22
DisplayName Synchronization Engine
ExplicitMember *** various ***
Filter /Person[ObjectID='FB89AEFA-5EA1-47F1-8890-ABE7797D6497']
ObjectType Set
62. All DEEWR users with passwords being reset ^Top
ObjectID All DEEWR users with passwords being reset
CreatedTime 7/07/2011 2:19:07
Description All users with passwords being reset
DisplayName All DEEWR users with passwords being reset
Filter /Person[DEEWR-unicodePwd != '#Invalid#']
ObjectType Set
Temporal False
63. DEEWR-All invitations that failed to resolve ^Top
ObjectID DEEWR-All invitations that failed to resolve
CreatedTime 13/05/2011 6:29:19
Description Invitations that failed to be resolved to a valid user
DisplayName DEEWR-All invitations that failed to resolve
Filter /DEEWR-esg-invitation[(DEEWR-userID != /Set[ObjectID = '8887df8e-6e84-49f2-a794-f9e9802077e0']/ComputedMember) and (not(DEEWR-esg-isAccepted = True)) and (not(DEEWR-esg-isAccepted = False))]
ObjectType Set
Temporal False
64. DEEWR-All unresolved invitations ^Top
ObjectID DEEWR-All unresolved invitations
CreatedTime 13/05/2011 5:42:17
Description User invitations which can be resolved to a valid user
DisplayName DEEWR-All unresolved invitations
Filter /DEEWR-esg-invitation[(DEEWR-userID != /Set[ObjectID = '8887df8e-6e84-49f2-a794-f9e9802077e0']/ComputedMember) and (DEEWR-esg-isAccepted = False)]
ObjectType Set
Temporal False
65. DEEWR-Invitations with resolved invitees ^Top
ObjectID DEEWR-Invitations with resolved invitees
CreatedTime 17/05/2011 7:37:32
Description Invitations which have successfully resolved to a FIM user
DisplayName DEEWR-Invitations with resolved invitees
Filter /DEEWR-esg-invitation[DEEWR-userID = /Set[ObjectID = '8887df8e-6e84-49f2-a794-f9e9802077e0']/ComputedMember]
ObjectType Set
Temporal False
66. All DEEWR Org Claims ^Top
ObjectID All DEEWR Org Claims
CreatedTime 12/07/2011 2:35:10
Description All DEEWR Org Claims
DisplayName All DEEWR Org Claims
Filter /DEEWR-claim[DEEWR-claimTypeID = 'b2d301a0-bf24-4da5-b104-1cee8bfa3a65']
ObjectType Set
Temporal False
67. DEEWR-All valid claims ^Top
ObjectID DEEWR-All valid claims
CreatedTime 6/05/2011 6:11:45
Description All claims with Claim ID Name already set
DisplayName DEEWR-All valid claims
Filter /DEEWR-claim[DEEWR-claimIDName != '%Invalid%']
ObjectType Set
Temporal False
68. All DEEWR Domain users for provisioning ^Top
ObjectID All DEEWR Domain users for provisioning
CreatedTime 16/02/2011 6:36:41
Description DEEWR-All Domain Users for provisioning (Note - this will need to be a different definition for ENETDEV vs. CONSTRUCTION)
DisplayName All DEEWR Domain users for provisioning
Filter /Person[(Domain = 'ENETDEV') and (starts-with(DisplayName, 'FIMTEST'))]
ObjectType Set
Temporal False
69. All DEEWR Password admins ^Top
ObjectID All DEEWR Password admins
CreatedTime 7/07/2011 7:27:39
Description All DEEWR admins who can reset passwords on behalf of other users
DisplayName All DEEWR Password admins
Filter /Person[(ObjectID = /Set[ObjectID = '582af6d0-1aa5-421e-a1d0-7b9fe3225350']/ComputedMember) or (ObjectID = /Set[ObjectID = '49cb130e-fb60-4baa-86fc-133c2580fcfd']/ComputedMember) or (ObjectID = /Set[ObjectID = 'd1263f6e-dc20-44fd-9f71-c7a9fd783b91']/ComputedMember)]
ObjectType Set
Temporal False
70. DEEWR-All rejected invitations ^Top
ObjectID DEEWR-All rejected invitations
CreatedTime 16/05/2011 12:50:03
Description All DEEWR invitations marked as rejected and ready for deletion
DisplayName DEEWR-All rejected invitations
Filter /DEEWR-esg-invitation[(DEEWR-userID = /Set[ObjectID = '8887df8e-6e84-49f2-a794-f9e9802077e0']/ComputedMember) and (DEEWR-esg-isAccepted = False)]
ObjectType Set
Temporal False
71. All DEEWR ESS SEC users ^Top
ObjectID All DEEWR ESS SEC users
CreatedTime 8/06/2011 7:55:27
Description All DEEWR ESS SEC users
DisplayName All DEEWR ESS SEC users
Filter /Person[DEEWR-roleID = 'c0fa6d65-e7f6-49f8-9069-76df322b4880']
ObjectType Set
Temporal False
72. All DEEWR-esg-Global Role Templates ^Top
ObjectID All DEEWR-esg-Global Role Templates
CreatedTime 25/05/2011 6:11:25
Description Note: this is using a placeholder for criteria until we determine how global groups will be differentiated
DisplayName All DEEWR-esg-Global Role Templates
Filter /DEEWR-esg-roleTemplate[starts-with(Description, 'Global:')]
ObjectType Set
Temporal False
73. All DEEWR Site Claims ^Top
ObjectID All DEEWR Site Claims
CreatedTime 12/07/2011 2:34:14
Description All DEEWR Site Claims
DisplayName All DEEWR Site Claims
Filter /DEEWR-claim[DEEWR-claimTypeID = '622173d5-6e23-44db-a6ce-c4bd5ae589fe']
ObjectType Set
Temporal False
74. All DEEWR Developers ^Top
ObjectID All DEEWR Developers
CreatedTime 14/04/2011 13:49:55
Description All DEEWR Developers
DisplayName All DEEWR Developers
ExplicitMember *** various ***
ObjectType Set
75. All DEEWR ESS EMS users ^Top
ObjectID All DEEWR ESS EMS users
CreatedTime 8/06/2011 7:37:25
Description All DEEWR ESS EMS users
DisplayName All DEEWR ESS EMS users
Filter /Person[DEEWR-roleID = 'bb817524-e2e5-44b1-897d-0a78a7b2730e']
ObjectType Set
Temporal False
76. All DEEWR Users with reset password DREs ^Top
ObjectID All DEEWR Users with reset password DREs
CreatedTime 7/07/2011 3:54:01
Description All Users with reset password DREs
DisplayName All DEEWR Users with reset password DREs
Filter /Person[DetectedRulesList = /Set[ObjectID='28f0ada7-0fae-4b22-94b6-c134bc8687aa']/ComputedMember]
ObjectType Set
Temporal False
77. All DEEWR user role assignments which exclude OSC and SSC ^Top
ObjectID All DEEWR user role assignments which exclude OSC and SSC
CreatedTime 8/07/2011 6:22:49
Description All DEEWR-esg-userRole assignments which exclude both OSCs and SSCs. This set is used to keep non OSC/SSC role assignments in sync with Person.DEEWR-roleID
DisplayName All DEEWR user role assignments which exclude OSC and SSC
Filter /DEEWR-esg-userRole[(not(DEEWR-assignedRoleID = 'a4542174-d09f-4a6d-811e-9ceaa620b9c6')) and (not(DEEWR-assignedRoleID = '8965fc59-34ec-44b4-be53-84f26190189d'))]
ObjectType Set
Temporal False
78. All DEEWR OSC Org Assignments ^Top
ObjectID All DEEWR OSC Org Assignments
CreatedTime 31/05/2011 6:43:12
Description All DEEWR OSC Org Assignments
DisplayName All DEEWR OSC Org Assignments
Filter /DEEWR-esg-userRole[DEEWR-assignedRoleID = 'a4542174-d09f-4a6d-811e-9ceaa620b9c6']
ObjectType Set
Temporal False
79. All DEEWR SSC Site Assignments ^Top
ObjectID All DEEWR SSC Site Assignments
CreatedTime 31/05/2011 6:44:06
Description All DEEWR SSC Site Assignments
DisplayName All DEEWR SSC Site Assignments
Filter /DEEWR-esg-userRole[DEEWR-assignedRoleID = '8965fc59-34ec-44b4-be53-84f26190189d']
ObjectType Set
Temporal False
80. All Distribution Groups ^Top
ObjectID All Distribution Groups
CreatedTime 25/10/2010 14:39:22
DisplayName All Distribution Groups
Filter /Group[Type="Distribution"]
ObjectType Set
81. All Active People ^Top
ObjectID All Active People
CreatedTime 25/10/2010 14:39:22
DisplayName All Active People
Filter /Person
ObjectType Set
82. Owner Approved Distribution Groups ^Top
ObjectID Owner Approved Distribution Groups
CreatedTime 25/10/2010 14:39:22
DisplayName Owner Approved Distribution Groups
Filter /Group[(MembershipAddWorkflow='Owner Approval') and (Type='Distribution')]
ObjectType Set
83. Open Distribution Groups ^Top
ObjectID Open Distribution Groups
CreatedTime 25/10/2010 14:39:22
DisplayName Open Distribution Groups
Filter /Group[(MembershipLocked=false) and (MembershipAddWorkflow='None') and (Type='Distribution')]
ObjectType Set
84. Static Distribution Groups ^Top
ObjectID Static Distribution Groups
CreatedTime 25/10/2010 14:39:22
DisplayName Static Distribution Groups
Filter /Group[(MembershipLocked = False) and (Type = 'Distribution')]
ObjectType Set
Temporal False
85. All Groups and Sets ^Top
ObjectID All Groups and Sets
CreatedTime 25/10/2010 14:39:22
DisplayName All Groups and Sets
Filter /*[ObjectType='Group' or ObjectType='Set']
ObjectType Set
86. All Basic Configuration Objects ^Top
ObjectID All Basic Configuration Objects
CreatedTime 25/10/2010 14:39:22
DisplayName All Basic Configuration Objects
Filter /*[(ObjectID=/Set[ObjectID='6AA1B9B1-D3E5-4708-BFE2-F1EA1578C090']/ComputedMember) or (ObjectID=/Set[ObjectID='7EECBA2C-B2C9-4C8B-8ACB-8EADB059E7E3']/ComputedMember) or (ObjectID=/Set[ObjectID='C07B25FA-7334-41F0-86E5-0AC468A16CFC']/ComputedMember) or (ObjectID=/Set[ObjectID='6C69DCC6-502F-4D44-9849-03B99B00EE8B']/ComputedMember) or (ObjectID=/Set[ObjectID='8196B5A7-F54F-4907-85DE-F050A058E09E']/ComputedMember) or (ObjectID=/Set[ObjectID='473E901C-4F53-4EDD-AFB0-449CC7086F5C']/ComputedMember) or (ObjectID=/Set[ObjectID='B4990506-A894-4EC2-8D68-A7A724DF985E']/ComputedMember) or (ObjectID=/Set[ObjectID='BC78B73E-CAF0-478F-A3B9-3F7FDE9F92B4']/ComputedMember) or (ObjectID=/Set[ObjectID='5D73E291-9C88-4126-9B13-C910E54C5328']/ComputedMember) or (ObjectID=/Set[ObjectID='0EE48723-55F9-45A7-B343-25D673B820F8']/ComputedMember) or (ObjectID=/Set[ObjectID='88A0AAD6-D9EB-454B-9BFB-B7007E3F0BE7']/ComputedMember) or (ObjectID=/Set[ObjectID='69CBC791-AD1C-46B0-8EFF-66E06B368C75']/ComputedMember)]
ObjectType Set
87. All Groups ^Top
ObjectID All Groups
CreatedTime 25/10/2010 14:39:22
DisplayName All Groups
Filter /Group
ObjectType Set
88. All Dynamic Groups ^Top
ObjectID All Dynamic Groups
CreatedTime 25/10/2010 14:39:22
DisplayName All Dynamic Groups
Filter /Group[MembershipLocked=true]
ObjectType Set
89. All Static Groups ^Top
ObjectID All Static Groups
CreatedTime 25/10/2010 14:39:22
DisplayName All Static Groups
Filter /Group[MembershipLocked=false]
ObjectType Set
90. Owner Approved Groups ^Top
ObjectID Owner Approved Groups
CreatedTime 25/10/2010 14:39:22
DisplayName Owner Approved Groups
Filter /Group[MembershipAddWorkflow="Owner Approval"]
ObjectType Set
91. Open Groups ^Top
ObjectID Open Groups
CreatedTime 25/10/2010 14:39:22
DisplayName Open Groups
Filter /Group[(MembershipLocked=false) and (MembershipAddWorkflow="None")]
ObjectType Set
92. Group Administrators ^Top
ObjectID Group Administrators
CreatedTime 25/10/2010 14:39:22
DisplayName Group Administrators
Filter /Person[ObjectID = /Set[ObjectID = '10000005-1111-45b5-ad13-2764d866c000']/ComputedMember]
ObjectType Set
Temporal False
93. All Approvals ^Top
ObjectID All Approvals
CreatedTime 25/10/2010 14:39:22
DisplayName All Approvals
Filter /Approval
ObjectType Set
94. All Approval Responses ^Top
ObjectID All Approval Responses
CreatedTime 25/10/2010 14:39:22
DisplayName All Approval Responses
Filter /ApprovalResponse
ObjectType Set
95. Requests To Be Canceled ^Top
ObjectID Requests To Be Canceled
CreatedTime 25/10/2010 14:39:22
DisplayName Requests To Be Canceled
Filter /Request[(RequestControl ="CancelOperation")]
ObjectType Set
96. All Security Groups ^Top
ObjectID All Security Groups
CreatedTime 25/10/2010 14:39:22
DisplayName All Security Groups
Filter /Group[(Type="Security") or (Type="MailenabledSecurity")]
ObjectType Set
97. Security Group Users ^Top
ObjectID Security Group Users
CreatedTime 25/10/2010 14:39:22
DisplayName Security Group Users
Filter /Person[ObjectID = /Set[ObjectID = '10000005-1111-45b5-ad13-2764d866c000']/ComputedMember]
ObjectType Set
Temporal False
98. Owner Approved Security Groups ^Top
ObjectID Owner Approved Security Groups
CreatedTime 25/10/2010 14:39:22
DisplayName Owner Approved Security Groups
Filter /Group[(MembershipAddWorkflow='Owner Approval') and (Type='Security' or Type='MailenabledSecurity')]
ObjectType Set
99. Static Security Groups ^Top
ObjectID Static Security Groups
CreatedTime 25/10/2010 14:39:22
DisplayName Static Security Groups
Filter /Group[(MembershipLocked = False) and ((Type = 'Security') or (Type = 'MailEnabledSecurity'))]
ObjectType Set
Temporal False
100. Open Security Groups ^Top
ObjectID Open Security Groups
CreatedTime 25/10/2010 14:39:22
DisplayName Open Security Groups
Filter /Group[(MembershipLocked=false) and (MembershipAddWorkflow='None') and (Type='Security' or Type='MailenabledSecurity')]
ObjectType Set
101. All expected rule resources ^Top
ObjectID All expected rule resources
CreatedTime 25/10/2010 14:39:22
DisplayName All expected rule resources
Filter /ExpectedRuleEntry
ObjectType Set
102. All Synchronization Related Resources ^Top
ObjectID All Synchronization Related Resources
CreatedTime 25/10/2010 14:39:22
DisplayName All Synchronization Related Resources
Filter /*[ObjectType='SynchronizationFilter' or ObjectType='SynchronizationRule' or ObjectType='Function' or ObjectType='DetectedRuleEntry' or ObjectType='ExpectedRuleEntry' or ObjectType='ma-data' or ObjectType='mv-data']
ObjectType Set
103. All Detected Rule Resources ^Top
ObjectID All Detected Rule Resources
CreatedTime 25/10/2010 14:39:22
DisplayName All Detected Rule Resources
Filter /DetectedRuleEntry
ObjectType Set
104. Expiring Group Resources ^Top
ObjectID Expiring Group Resources
CreatedTime 25/10/2010 14:39:22
DisplayName Expiring Group Resources
Filter /Group[ExpirationTime < op:add-dayTimeDuration-to-dateTime(fn:current-dateTime(), xs:dayTimeDuration("P14DT0H0M"))]
ObjectType Set
ResourceTime 13/07/2011 15:00:01
Temporal True
1. DEEWR - Event Broker Data Changes ^Top
ObjectID DEEWR - Event Broker Data Changes
CreatedTime 25/02/2011 0:27:47
Description This workflow writes to the log file used to inform the FIM MA to import data changes only
DisplayName DEEWR - Event Broker Data Changes
ObjectType WorkflowDefinition
RequestPhase Action
RunOnPolicyUpdate False
XOML *** embedded xml ***
2. DEEWR-Apply invitation to entitlements ^Top
ObjectID DEEWR-Apply invitation to entitlements
CreatedTime 16/05/2011 8:25:12
Description Copy approved ORG and SITE entitlements to the invitee's user record and delete the processed invitation
DisplayName DEEWR-Apply invitation to entitlements
ObjectType WorkflowDefinition
RequestPhase Action
RunOnPolicyUpdate False
XOML *** embedded xml ***
3. DEEWR-Delete Object by ID ^Top
ObjectID DEEWR-Delete Object by ID
CreatedTime 12/05/2011 6:51:11
Description Delete an object for a given resource ID
DisplayName DEEWR-Delete Object by ID
ObjectType WorkflowDefinition
RequestPhase Action
RunOnPolicyUpdate True
XOML *** embedded xml ***
4. DEEWR-Remove user role assignment by ID ^Top
ObjectID DEEWR-Remove user role assignment by ID
CreatedTime 31/05/2011 9:25:40
Description Remove a user role assignment by ID
DisplayName DEEWR-Remove user role assignment by ID
ObjectType WorkflowDefinition
RequestPhase Action
RunOnPolicyUpdate True
XOML *** embedded xml ***
5. DEEWR-Set claim sync values ^Top
ObjectID DEEWR-Set claim sync values
CreatedTime 19/04/2011 5:31:43
Description Set the redundantly stored display name value for each referenced claim binding to sync to the claims database
DisplayName DEEWR-Set claim sync values
ObjectType WorkflowDefinition
RequestPhase Action
RunOnPolicyUpdate False
XOML *** embedded xml ***
6. DEEWR-Create or update user ADMIN ROLE claims ^Top
ObjectID DEEWR-Create or update user ADMIN ROLE claims
CreatedTime 1/06/2011 2:01:32
Description Create or update user ADMIN ROLE claims
DisplayName DEEWR-Create or update user ADMIN ROLE claims
ObjectType WorkflowDefinition
RequestPhase Action
RunOnPolicyUpdate False
XOML *** embedded xml ***
7. DEEWR-Delete user ADMIN ROLE claims ^Top
ObjectID DEEWR-Delete user ADMIN ROLE claims
CreatedTime 23/06/2011 8:06:07
Description Delete invalid ADMIN ROLE claims for a user
DisplayName DEEWR-Delete user ADMIN ROLE claims
ObjectType WorkflowDefinition
RequestPhase Action
RunOnPolicyUpdate False
XOML *** embedded xml ***
8. DEEWR-Create or update user ESG ORG claims ^Top
ObjectID DEEWR-Create or update user ESG ORG claims
CreatedTime 9/05/2011 10:36:10
Description Create or update user ESG ORG claims
DisplayName DEEWR-Create or update user ESG ORG claims
ObjectType WorkflowDefinition
RequestPhase Action
RunOnPolicyUpdate False
XOML *** embedded xml ***
9. DEEWR-Delete user ESG ORG claims ^Top
ObjectID DEEWR-Delete user ESG ORG claims
CreatedTime 28/06/2011 7:54:19
Description Delete invalid ESG ORG claims for a user
DisplayName DEEWR-Delete user ESG ORG claims
ObjectType WorkflowDefinition
RequestPhase Action
RunOnPolicyUpdate False
XOML *** embedded xml ***
10. DEEWR-Create or update user ESG ROLE claims ^Top
ObjectID DEEWR-Create or update user ESG ROLE claims
CreatedTime 9/05/2011 10:42:20
Description Create or update user ESG ROLE claims
DisplayName DEEWR-Create or update user ESG ROLE claims
ObjectType WorkflowDefinition
RequestPhase Action
RunOnPolicyUpdate False
XOML *** embedded xml ***
11. DEEWR-Delete user ESG ROLE claims ^Top
ObjectID DEEWR-Delete user ESG ROLE claims
CreatedTime 28/06/2011 8:30:24
Description Delete ESG ROLE claims for a user
DisplayName DEEWR-Delete user ESG ROLE claims
ObjectType WorkflowDefinition
RequestPhase Action
RunOnPolicyUpdate False
XOML *** embedded xml ***
12. DEEWR-Create or update user ESG SITE claims ^Top
ObjectID DEEWR-Create or update user ESG SITE claims
CreatedTime 21/04/2011 4:22:02
Description Create or update user ESG SITE claims
DisplayName DEEWR-Create or update user ESG SITE claims
ObjectType WorkflowDefinition
RequestPhase Action
RunOnPolicyUpdate False
XOML *** embedded xml ***
13. DEEWR-Delete user ESG SITE claims ^Top
ObjectID DEEWR-Delete user ESG SITE claims
CreatedTime 28/06/2011 8:28:47
Description Delete invalid ESG SITE claims for a user
DisplayName DEEWR-Delete user ESG SITE claims
ObjectType WorkflowDefinition
RequestPhase Action
RunOnPolicyUpdate False
XOML *** embedded xml ***
14. DEEWR-Delete invalid user claims for Org and Application ^Top
ObjectID DEEWR-Delete invalid user claims for Org and Application
CreatedTime 9/05/2011 9:10:22
Description Delete invalid user claims for ORG and APPLICATION
DisplayName DEEWR-Delete invalid user claims for Org and Application
ObjectType WorkflowDefinition
RequestPhase Action
RunOnPolicyUpdate False
XOML *** embedded xml ***
15. DEEWR-Set derived DisplayName and Description for DEEWR-esg-userRole records ^Top
ObjectID DEEWR-Set derived DisplayName and Description for DEEWR-esg-userRole records
CreatedTime 8/07/2011 0:40:07
Description Set derived DisplayName and Description
DisplayName DEEWR-Set derived DisplayName and Description for DEEWR-esg-userRole records
ObjectType WorkflowDefinition
RequestPhase Action
RunOnPolicyUpdate False
XOML *** embedded xml ***
16. DEEWR-Clean up after user account is provisioned ^Top
ObjectID DEEWR-Clean up after user account is provisioned
CreatedTime 7/07/2011 2:40:20
Description Need to clear out the initial password field
DisplayName DEEWR-Clean up after user account is provisioned
ObjectType WorkflowDefinition
RequestPhase Action
RunOnPolicyUpdate False
XOML *** embedded xml ***
17. DEEWR-Remove invalid esg roles for user sites ^Top
ObjectID DEEWR-Remove invalid esg roles for user sites
CreatedTime 11/05/2011 1:15:50
Description Remove any role selections for a user which no longer match the selected sites (via site-contract-role or org-role)
DisplayName DEEWR-Remove invalid esg roles for user sites
ObjectType WorkflowDefinition
RequestPhase Action
RunOnPolicyUpdate False
XOML *** embedded xml ***
18. DEEWR-Remove invalid esg sites and roles for user orgs ^Top
ObjectID DEEWR-Remove invalid esg sites and roles for user orgs
CreatedTime 6/05/2011 4:38:03
Description Remove any site and role selections for a user which no longer match the selected orgs
DisplayName DEEWR-Remove invalid esg sites and roles for user orgs
ObjectType WorkflowDefinition
RequestPhase Action
RunOnPolicyUpdate False
XOML *** embedded xml ***
19. DEEWR-Delete invitation where invitee not resolved ^Top
ObjectID DEEWR-Delete invitation where invitee not resolved
CreatedTime 13/05/2011 6:31:54
Description Delete a DEEWR invitation where invitee cannot be resolved
DisplayName DEEWR-Delete invitation where invitee not resolved
ObjectType WorkflowDefinition
RequestPhase Action
RunOnPolicyUpdate True
XOML *** embedded xml ***
20. DEEWR-Resolve org invitee ^Top
ObjectID DEEWR-Resolve org invitee
CreatedTime 13/05/2011 5:30:16
Description Resolve the invitee on a new org (only) invitation
DisplayName DEEWR-Resolve org invitee
ObjectType WorkflowDefinition
RequestPhase Action
RunOnPolicyUpdate False
XOML *** embedded xml ***
21. DEEWR-Notify invitee resolved OK ^Top
ObjectID DEEWR-Notify invitee resolved OK
CreatedTime 17/05/2011 7:45:55
Description A notification (to the inviter for now) is sent when an invitee is successfully resolved to a FIM user
DisplayName DEEWR-Notify invitee resolved OK
ObjectType WorkflowDefinition
RequestPhase Action
RunOnPolicyUpdate True
XOML *** embedded xml ***
22. DEEWR-Set OSCs for a user ^Top
ObjectID DEEWR-Set OSCs for a user
CreatedTime 17/05/2011 7:14:02
Description Users assigned to a ORG must also be linked to the set of corresponding OSCs
DisplayName DEEWR-Set OSCs for a user
ObjectType WorkflowDefinition
RequestPhase Action
RunOnPolicyUpdate False
XOML *** embedded xml ***
23. DEEWR-Outbound workflow for Claims to SQL ^Top
ObjectID DEEWR-Outbound workflow for Claims to SQL
CreatedTime 19/04/2011 2:04:40
Description Provision claims to SQL and bring back the SQL key (Claim ID)
DisplayName DEEWR-Outbound workflow for Claims to SQL
ObjectType WorkflowDefinition
RequestPhase Action
RunOnPolicyUpdate True
XOML *** embedded xml ***
24. DEEWR-Outbound Workflow for Users to AD ^Top
ObjectID DEEWR-Outbound Workflow for Users to AD
CreatedTime 16/02/2011 23:42:05
Description Outbound Workflow for Users to AD
DisplayName DEEWR-Outbound Workflow for Users to AD
ObjectType WorkflowDefinition
RequestPhase Action
RunOnPolicyUpdate True
XOML *** embedded xml ***
25. DEEWR-Reset user account password ^Top
ObjectID DEEWR-Reset user account password
CreatedTime 9/06/2011 8:05:05
Description Reset user account password
DisplayName DEEWR-Reset user account password
ObjectType WorkflowDefinition
RequestPhase Action
RunOnPolicyUpdate False
XOML *** embedded xml ***
26. DEEWR-Delete rejected invitation ^Top
ObjectID DEEWR-Delete rejected invitation
CreatedTime 16/05/2011 12:38:22
Description Delete a DEEWR invitation which has been rejected
DisplayName DEEWR-Delete rejected invitation
ObjectType WorkflowDefinition
RequestPhase Action
RunOnPolicyUpdate True
XOML *** embedded xml ***
27. DEEWR-Set SSCs for a user ^Top
ObjectID DEEWR-Set SSCs for a user
CreatedTime 12/07/2011 2:32:20
Description Users assigned to a SITE must also be linked to the set of corresponding SSCs
DisplayName DEEWR-Set SSCs for a user
ObjectType WorkflowDefinition
RequestPhase Action
RunOnPolicyUpdate False
XOML *** embedded xml ***
28. DEEWR-Clean up after user account password is reset ^Top
ObjectID DEEWR-Clean up after user account password is reset
CreatedTime 9/06/2011 8:06:26
Description Clean up after user account password is reset
DisplayName DEEWR-Clean up after user account password is reset
ObjectType WorkflowDefinition
RequestPhase Action
RunOnPolicyUpdate False
XOML *** embedded xml ***
29. DEEWR-Sync user roles ^Top
ObjectID DEEWR-Sync user roles
CreatedTime 8/07/2011 6:17:35
Description Sync user roles (other than OSC/SSC)
DisplayName DEEWR-Sync user roles
ObjectType WorkflowDefinition
RequestPhase Action
RunOnPolicyUpdate False
XOML *** embedded xml ***
30. DEEWR-Add org admins for an OSC ^Top
ObjectID DEEWR-Add org admins for an OSC
CreatedTime 18/05/2011 1:32:11
Description Users assigned to an ORG must also be updated when the set of corresponding OSCs changes (additions)
DisplayName DEEWR-Add org admins for an OSC
ObjectType WorkflowDefinition
RequestPhase Action
RunOnPolicyUpdate False
XOML *** embedded xml ***
31. DEEWR-Add site admins for an SSC ^Top
ObjectID DEEWR-Add site admins for an SSC
CreatedTime 18/05/2011 0:06:48
Description Users assigned to a SITE must also be updated when the set of corresponding SSCs changes (additions)
DisplayName DEEWR-Add site admins for an SSC
ObjectType WorkflowDefinition
RequestPhase Action
RunOnPolicyUpdate False
XOML *** embedded xml ***
32. DEEWR-Remove org admins for an OSC ^Top
ObjectID DEEWR-Remove org admins for an OSC
CreatedTime 18/05/2011 1:35:58
Description Users assigned to an ORG must also be updated when the set of corresponding OSCs changes (removals)
DisplayName DEEWR-Remove org admins for an OSC
ObjectType WorkflowDefinition
RequestPhase Action
RunOnPolicyUpdate False
XOML *** embedded xml ***
33. DEEWR-Remove site admins for an SSC ^Top
ObjectID DEEWR-Remove site admins for an SSC
CreatedTime 18/05/2011 1:06:40
Description Users assigned to a SITE must also be updated when the set of corresponding SSCs changes (removals)
DisplayName DEEWR-Remove site admins for an SSC
ObjectType WorkflowDefinition
RequestPhase Action
RunOnPolicyUpdate False
XOML *** embedded xml ***
34. Filter Validation Workflow for Administrators ^Top
ObjectID Filter Validation Workflow for Administrators
CreatedTime 25/10/2010 14:39:22
DisplayName Filter Validation Workflow for Administrators
ObjectType WorkflowDefinition
RequestPhase Authorization
XOML *** embedded xml ***
35. Filter Validation Workflow for Non-Administrators ^Top
ObjectID Filter Validation Workflow for Non-Administrators
CreatedTime 25/10/2010 14:39:22
DisplayName Filter Validation Workflow for Non-Administrators
ObjectType WorkflowDefinition
RequestPhase Authorization
XOML *** embedded xml ***
36. System Workflow Required for Registration ^Top
ObjectID System Workflow Required for Registration
CreatedTime 25/10/2010 14:39:22
Description This workflow is a system workflow that is required for any type of registration to work correctly, including registration for Self-service Password Reset. Removing this workflow is not possible.
DisplayName System Workflow Required for Registration
ObjectType WorkflowDefinition
RequestPhase Authentication
XOML *** embedded xml ***
37. Group Validation Workflow ^Top
ObjectID Group Validation Workflow
CreatedTime 25/10/2010 14:39:22
DisplayName Group Validation Workflow
ObjectType WorkflowDefinition
RequestPhase Authorization
XOML *** embedded xml ***
38. Owner Approval Workflow ^Top
ObjectID Owner Approval Workflow
CreatedTime 25/10/2010 14:39:22
DisplayName Owner Approval Workflow
ObjectType WorkflowDefinition
RequestPhase Authorization
XOML *** embedded xml ***
39. Requestor Validation Without Owner Authorization ^Top
ObjectID Requestor Validation Without Owner Authorization
CreatedTime 25/10/2010 14:39:22
DisplayName Requestor Validation Without Owner Authorization
ObjectType WorkflowDefinition
RequestPhase Authorization
XOML *** embedded xml ***
40. Requestor Validation With Owner Authorization ^Top
ObjectID Requestor Validation With Owner Authorization
CreatedTime 25/10/2010 14:39:22
DisplayName Requestor Validation With Owner Authorization
ObjectType WorkflowDefinition
RequestPhase Authorization
XOML *** embedded xml ***
41. Group Expiration Notification Workflow ^Top
ObjectID Group Expiration Notification Workflow
CreatedTime 25/10/2010 14:39:22
DisplayName Group Expiration Notification Workflow
ObjectType WorkflowDefinition
RequestPhase Action
RunOnPolicyUpdate False
XOML *** embedded xml ***