Admin Tasks › Define the Task Scope

Define the Task Scope

On the Search tab, you define the task scope, which limits the objects available to the task. For example, if the object of a task is users, you might define the scope as users who are contractors.

Note: If the task has no primary object, or if the action is self-modify, self-view, or approve, the Search tab does not appear.

You configure the following settings on the Search tab:

• Search Screen

  The search screen limits the scope of the task based on filters. Click the ... (ellipses) button to see available search screen options.

  Note: You may want to create your own search screen. To create a modified version of an existing search screen, select the search screen and click Copy. You can then modify the search screen without changing the original search screen definition. To create a new search screen, click New.

• Search Options

  The search options appear only when the object is a role or group.

  • The first option limits the search based on fields that are defined on the search screen. Within these limits, the search locates all groups or roles in the administrator's scope.
  • Other options limit the search as indicated.

    Note the following:

  • By default, the group search screens support filtering. This means that administrators can specify criteria to limit the scope of group searches. To remove the filtering capability, create a new search screen that does not contain any fields to include in a search query.
  • Filtering not supported, which appears on the Search tab when the object is a role, means that the task displays all of the roles that meet the criteria in the option you select. Search fields that are configured on the search screen are ignored.
• Modified objects must remain in administrator's scope

  When this check box is selected, Identity Manager displays an error if changes to the task cause the administrator to lose scope over the primary object. For example, an administrator may use Modify User to change a user's Employee Type attribute to Manager. This change may put the user outside the administrator's scope.