Shine a light on shadow apps

ConductorOne Docs

Configure entitlement review settings

Use the access reviews settings on an entitlement's details page to configure how the entitlement will be reviewed during access review campaigns.

Set a review policy for the entitlement

ConductorOne applies review policies using this order of precedence:

  1. The entitlement’s configuration
  2. The application’s configuration
  3. The campaign’s configuration

In other words, if an entitlement policy is set, it overrules both the campaign policy and the application policy.

If you want to make sure this entitlement uses a specific review policy, set it on the entitlement. You do not need to set a policy here if the entitlement can be reviewed using the policy set on its application or the policy set for a review campaign.

To learn more about creating custom review policies, go to Create policies.

To set a review policy for the entitlement:

  1. In the navigation panel, open Apps and click Applications.

  2. Select an application and click Entitlements.

  3. Select an entitlement. On the Details tab, in the Access reviews area of the page, click Edit.

  4. Use the Policy dropdown to locate and select the review policy that this entitlement should use.

  5. Click Save.

The entitlement’s review policy is set. This policy will be used for this entitlement during access review campaigns.

How entitlement bindings impact access reviews

Entitlements can be bound to each other. When a binding is in place, and you pull the bound entitlement into the access review, the entitlements bound to it should also be reviewed.

There are two types of bindings: Incoming (one entitlement is granted by another entitlement) or Outgoing (one entitlement entitlement grants another entitlement).

To view any bindings in effect, click the Bindings tab on the entitlement’s details page.