Skip to main content
Version: On prem: 15.0.3

Survey administration

In Omada Identity, survey administrators can administer and monitor surveys in the Omada Identity Portal. Survey administrators can:

  • Launch surveys and set their scope.
  • Schedule surveys.
  • Inspect questions assigned to a specific user.
  • Reassign individual questions to another user.
  • View reports (if enabled).
  • Close surveys.

In the Survey admins field, you can choose both Users and User groups objects as survey admins.

  • The Auditors user group can view all surveys in the Surveys view located in My data > Manage > My surveys. This view shows the same information as the one for survey administrators. However, auditors can only read information, and cannot reassign questions or close the survey.

  • The Operation administrators user group has full access to all surveys in the system. They can find the surveys in the Setup menu.- Operation administrators user group has full access to all surveys in the system. They can find the surveys in the Setup menu.

  • The System administrators user group has full access to surveys and can manage surveys. They can find the surveys under Setup menu and My data > Manage > My surveys.

  • The Data administrators user group has full access to surveys and can manage surveys. They can find the surveys under Setup menu and My data > Manage > My surveys.

Survey administration view​

As a survey administrator you can access the Surveys administrator view from Setup > Operations > Surveys. Note that you need to be a member of the Operations administrators group to be able to access this menu item.

All fields in both the grid and the forms are read-only in the admin screen. They can only be edited as part of a workflow.

The administration view shows the basic information about the survey:

  • The progress The number of submitted answers
  • The number of missing answers
  • The number of assignees
  • The list of assignees
  • The number of questions per assignee
  • The progress per assignee

Survey questions view​

Click the Details link under any assignee to see the detailed breakdown of the survey questions for this assignee. You can group the questions by workflow step, identity, and resource. You can also use filter to see only the questions related to a specific identity, resource, action, and so on. You can also download the list of questions in the PDF format.

info

In a parent/child survey, when you have an unassigned child resource and try to select an answer responsible to see the unassigned resources, then all assigned and unassigned resources, parent and children, will show up.

Survey object properties​

When you are in the survey questions view, click Details to drilldown to the properties of the survey object. You can also click any identity or resource to drilldown to the details about it.

Verdict surveys​

Omada Identity supports running access review surveys on the accounts and access rights that are calculated by RoPE. Such a survey is referred to as a Verdict survey because the outcome is an authoritative verdict as to whether an identity should have a certain account/access right or not.

RoPE takes these verdicts into account and creates calculated assignments based on the ones that have the verdict Keep. If an identity has the Remove verdict for a CRA (Calculated Resource Assignments), then RoPE marks the CRA as disabled, which leads to deprovisioning.

A CRA which has the Keep verdict has an assignment reason of the type Review OK. The Review OK reason type is special in the sense that it cannot be the only reason for a CRA. There must be another reason for its existence as well.

Revoke or expire existing assignments with a verdict It is possible to revoke CRAs that do not have a Desired state. The Revoke action is only available to members of the Operation administrator, System administrator, and Service desk users groups.

This action allows you to expire assignments without having to create survey campaigns or manipulate the data in the target system.

In the Resource assignments grid in the Identity form, in the context menu, the Revoke action is available if the CRAs are of the following types:

  • Direct
  • Actual direct
  • Unconfirmed actual
  • Review OK

When a CRA is revoked, a new Remove verdict is created, and if the CRA has one or more direct reasons, the resource assignment data objects that are causing them are also expired.

The expiration of direct assignments is done in the same way as the expire functionality for direct assignments works, whereby the Valid To date is set to the end of the day, and the status of the assignment is also set to Obsolete.

info

This procedure is a prerequisite for the procedure Approve existing assignments without running surveys.

Launch surveys​

Follow these steps to launch a survey:

  1. Go to Setup > Administration > More > All services.

  2. Click the icon for the survey in the process template widget in the user’s dashboard.

  3. In the Initiate Survey section of the Initiate activity, add a name, a description, and a deadline for the survey, and choose the survey administrators.

  4. Choose whether to enable mass editing for individual surveys. If you enable mass editing, the respondent will be able to edit multiple questions in the survey.

    note

    Refer to Enable mass edit to know how to enable mass edit option.

  5. If needed, click the View for reassigning survey questions field to select the scope of users who can be selected for reassigned questions in a survey.

    info

    If this field has a value, the survey assignees will have the option to reassign questions to any user defined by the selected view. This only applies to the respondents of the survey. The survey administrator can reassign to any user from the survey admin view.

  6. In the Scoping section, set the scope of the survey.

  7. In the Settings section, configure any additional settings that are relevant, for example, set the number of days before the expiration of the survey verdict (as in the example pictured below).

  8. Click Generate survey data to view the result of the selected scope. You can see the number of objects per workflow step and the calculated assignees in the Overview tab.

  9. When you click Generate survey data, the survey is created but not yet launched.

  10. Review all questions generated by the survey in the Details tab.

  11. If you do not need to make any changes to the scope, click Launch survey tasks to launch the survey. The questions will be then assigned as work items. Click Go back to edit the survey scope and settings before launch.

    info

    When the survey is launched, email notifications will be sent out to the respondents. This option is configured by default but can be disabled if needed. Surveys can also be launched from the Compliance workbench by system owners. Surveys are available after clicking the **“…” **context menu next to any of the systems listed.

  12. To provide a value for the post-action parameter, before launching a survey, go to the Initiate Survey view and use the value of the settings field, which is mapped to the post-action parameter.

warning

If no survey questions are generated when clicking the Generate survey data button in the survey initiate activity, a confirmation dialog will be shown to inform the user that no questions could be generated. Clicking the Ok button in the dialog will redirect the user to the initial activity. The user will now have an active task for the initiating activity of the survey.To delete it, go to My data > Manage > My surveys. Click on the ellipsis (...) button and click on Delete.

Schedule surveys​

You can schedule surveys to trigger using a Timer.

  1. Create a survey schedule under Setup > Administration > Data Management > Survey schedules.

    info

    When a scheduled survey starts, the people that should answer the survey are notified via email and receive a regular survey task in their Tasks view.

  2. While scheduling a survey, you can ask the system to confirm a scheduled survey before sending the tasks by selecting Confirm before launch?.

  3. When you have selected this option, the system sends a task to survey owners to review the survey data before launching survey tasks to the respondents.

Reassign surveys​

In a survey campaign, you can enable survey assignees to reassign their questions to any user included in a special view configured for the survey.

  1. In the Survey initiation form, click the Select view for reassigning field to select the scope of users or audience for reassignment.
  2. Pick the default survey reassignment view in the system (Survey reassignment view > All users) by selecting it in the View for reassigning survey questions field when launching a new survey instance. The survey responders must have the Read access to the users in the view in order to be able to reassign surveys to them.

When the view is selected, a Reassign button is available in the survey. The two UI actions: Download PDF and Reassign are now available from the context menu “…”.

Follow these steps to reassign a question:

  1. Select it and click the Reassign button.
  2. In the popup window, select the user that you will reassign the question to and click OK.
info

When reassigning questions as a survey admin. A different view is used for showing the user selection dialog. This view is the default Users view located in Setup > Administration > Users&Security > Users with the UId e9b4ee78-8f40-4cad-b175-6edce7ccbc4b. You can modify this view and replace it by adding a custom JS file to any survey template which uses the client-side API for the survey module to override the default reassigning view for survey admins, for example:

omada.attestation.configuration.AdminAssigneeViewUId = function ()
{
return "UId of view containing users selectable for reassigning";
}
warning

When reassigning child questions, make sure you do not select child questions across different pages. Otherwise, the child questions you have selected could be unselected when going forward on different pages.

Reassign survey activities as Service agent desk​

For Service desk agents to be able to reassign survey activities (or activities that involve answering survey questions, and not initiation and verification activities), add the Service desk agents user group to the Survey Admins property.

To do so:

  1. Start a new survey instance for any survey.

  2. In the Initiate Survey dialog, in the Survey admins field, enter Service desk agents and add it.

    info

    You can also change the target object of the survey template, so it always includes the Service Desk Agent user group in the Survey admins property.

Close surveys​

When all survey questions have been answered in all workflow steps, the survey is closed. The status of the survey is set to Complete, and any defined post actions are executed. The answers are logged into a survey object change log.

info

It is possible to close a survey before all questions have been answered. This can be done by Survey administrators in the Survey Administrator view. The status of the survey is set to “Complete”, all work items are closed, the process is terminated, and any defined post actions are executed.

To close the survey:

  1. Go to Setup > Operations > Surveys and click a given survey to open it.
  2. Click the Close Survey button.
  3. Click OK in the confirmation dialog.

Survey object change log​

The answers submitted or saved in a survey are stored in a survey object change log in order to be able to track answers given. This change log tracks the workflow steps in addition to the other attributes, such as the responder and the answer.

By default, survey changes update the existing log entries. The previous log entry is deleted, and a new entry is created with the information from both old event and new event. The default behavior can be changed by setting the value of the customer setting LogIdenticalEntriesInSurveys to “True”. When it is set to “True”, separate entries are logged every time the survey property (decision) is modified.

Instead of controlling the logging behavior with the customer setting, it is possible to run the following SQL script:

IF NOT EXISTS(SELECT 1 FROM [dbo].[tblCustomerSetting] WHERE 
[key]='LogIdenticalEntriesInSurveys') 

BEGIN 

INSERT INTO [dbo].[tblCustomerSetting] ([Key],[Name],
[Description],[ValueBool],[Type],[Category]) 

    VALUES ('LogIdenticalEntriesInSurveys', N'Log identical 
entries in surveys', N'Do not delete old versions of log 
entries', 1, 0, 'Defaults') 

END

Resync recertification data​

In some rare cases, it may be needed to re-sync the data, for example, when there is a loss of connection and the data is not correctly updated. The resync of the recertification surveys data should be used when:

  • An obvious inconsistency within Recertification KPIs is discovered.
  • Instructed to do so by support after some system breakdown.

With this functionality, the refresh of recertification surveys starts. The process runs in the background and sends messages with survey data to the analytics processing queue. After all messages are sent information will be logged.

Analytics process will then flag all existing recertification data as deleted and upload the new data from queue into tabular model which is the source of Recertification KPIs.

info

Data flagged as deleted is permanently removed from storage after 24 hours.

The functionality can also be called directly using web service call:

https://<<application-url>>/WebService/IntegrationManagementService.asmx?
op=ExecuteAccessReviewReload

Follow these steps to resync recertification data:

  1. Navigate to Setup > Surveys context menu > Refresh analytics data. This option is available only for Administrators.

  2. A dialog with notification will display. Click OK.

  3. Confirmation dialog will display. Click OK.

info

Refer to Use case article to see an example.