Administration Guide › CA Role & Compliance Manager Integration › Suggested Provisioning Roles › Criteria for Suggested Roles

Criteria for Suggested Roles

CA RCM suggests provisioning roles for a user based on one or more of the following criteria:

• Matches Rule

  CA RCM suggests provisioning roles if the current user matches the rule that determines membership in the CA RCM rule-based role.

  For example, the Sales Manager role has the following matching rule: Title = Sales Manager. If a user has Title=Sales manager but is not a member of Sales Manager role, CA RCM suggests this role for this user.

• Matched Privileges

  CA RCM suggests provisioning roles that users who have similar privileges to the current user also have. Privileges include accounts, roles, group membership, and other entitlements.

  For example, most users who have a UNIX account and access to the IT support database have the IT Help Desk role. CA RCM suggests the IT Help Desk role for all users who have a UNIX account and access to the IT support database.

  In this case, CA RCM determines the likelihood that a suggested role is a good match by using the following criteria:

  • How closely the privileges from other users match the privileges of the current user
  • How many users with matching privileges have the role
• Matched Attributes

  CA RCM suggests provisioning roles that users who have similar attributes to the current user also have.

  For example, an administrator wants to assign roles to an employee who has the following attributes in his profile:

  • Title: Sales Associate
  • Manager: Bob Folchart
  • Office: Northeast

  Users who have the same title, manager, and office have the Employee and Northeast Sales Associate roles. CA RCM suggests these roles for assignment.

  CA RCM calculates the probability that the suggested role is a match for the user by using the following criteria:

  • How closely the attributes from other users match the attributes of the current user
  • How many users with matching attributes have the role

  The best matches have the highest number of matching attributes and the largest number of users with the same role. For example, ten users who have the title Sales Associate and the Manager Bob Folchart have the Remote Employee role. Five users who are located in the Northeast office have the Quota-based Salary role. The Remote Employee role would receive a better match rating than the Quota-based Salary role.

• Almost Has

  CA RCM compares the privileges that a user has to existing provisioning roles. If the user has most of the privileges defined by a role, CA RCM suggests the role. This type of suggested role helps minimize the number of individual privileges a user has, and the number of roles in the system.

  Note: The Almost Has option is not available when you are creating a new user.

  To calculate the probability that a suggested role is a good match for a user in this case, CA RCM considers the following criteria:

  • How many entitlements are included in the provisioning role
  • How many of the entitlements the user already has

  For example, a user has an Exchange account, a UNIX account, and is a member of the Product Team group. Based on these privileges, CA RCM suggests two provisioning roles:

  • Employee role, which gives users an Exchange account and a Unix account, and makes the user a member of the Product Team group.
  • UNIX Administrator role, which gives users a UNIX account.

  In this example, the Employee role is considered a better match than the UNIX administrator role.