Presenter: This video will cover agency CAIA SailPoint
new user approval processes for G-Invoicing Administrators.
We will cover the following, Release 6.0 CAIA,
CAIA G-Invoicing Access Information,
Supervisor/Manager Approval 1 Process,
SailPoint Approval 2 Process,
G-Invoicing User Administrator-New User Creation Process,
FAQ-Things to Know,
Requestor Process/Approver Flow,
and lastly, Treasury Support Center or TSC: CAIA Support.
To meet Treasury's requirements
for securing agency access to Treasury applications,
CAIA or Common Approach to Identity Assurance
is being implemented with G-Invoicing.
The new Treasury mandate is for CAIA
to be implemented by the end of Q4 2023 calendar year
for all fiscal accounting applications.
Agency users will need to utilize either their PIC/CAC
or ID.me for identity verification
and access to G-Invoicing.
Below, we see the links for approving access
and for accessing G-Invoicing.
To access CAIA/SailPoint, use these iiq URL links.
New users will use these links to request new access
to G-Invoicing by accessing SailPoint
and requesting new SailPoint roles.
Administrators will use these iiq URL links
to approve new user access
and for managing existing SailPoint roles.
The G-Invoicing environment URLs
are useful for accessing G-Invoicing,
post identification verification,
authorized G-Invoicing users
and also master administrators and user administrators
for G-Invoicing can access via these links here.
This slide displays the path for managing user approvals
and SailPoint and G-Invoicing.
Beginning with the initial approvals
by the supervisor manager, the supervisor manager
would receive a CAIA email notification.
The supervisor manager would then access SailPoint
and either provide their approval or denial
of the initial user request for accessing G-Invoicing.
A notification would be sent to the user.
Following this step, the SailPoint approver
would then be notified
if this supervisor manager did provide their approval.
The SailPoint approver would be notified
via email notification.
The SailPoint approver would then access SailPoint, review,
and either approve or deny the user role request.
A CAIA notification would be sent
to both the user and to the supervisor manager.
The supervisor manager would need to contact
the G-Invoicing user administrator for the final step.
The G-Invoicing user administrator
would need to add the user in G-Invoicing
as well as adding organizational groups and roles
to the user account as per agency need.
This slide summarizes
the supervisor manager approving process.
First, the requester identifies the SailPoint
supervisor managers email address in SailPoint.
The user then requests SailPoint roles.
The supervisor manager either approves
or disapproves this request.
Following the approval by the supervisor manager,
a CAIA email is sent to the SailPoint approvers
for notification purposes.
This slide provides a quick view
of the approval screen in SailPoint.
We can see the Approval box, the Notification button.
We can see a listing on the right
of the latest approval listings.
We also could see, down at the bottom,
Approved Direct Reports for the supervisor manager.
The supervisor manager would want to select the approvals
on the top left in order to access requester requests
to supply their review, approvals, and denials.
This slide provides a view
after the supervisory manager selects the Approval button.
On the top left, we see an Approve All.
This allows an approver to blanket approve
or deny the user SailPoint role requests.
On the right-hand side, we can see the Comments icon.
This icon permits the approver
to review requestors notations prior to approving
or denying SailPoint role requests.
Supervisor managers can review comments
per SailPoint role request.
Approve, this allows the approver to provide approvals
or denials per SailPoint role request.
This appears below.
This indicates that the approval
or denial was successfully applied.
A notification email will then be sent
to the SailPoint approver
for the supervisor manager's approvals.
The CAIA email will include the requestor identity
and email address to request information
such as SailPoint role access requested.
A link will be supplied for the SailPoint approver
to select and access SailPoint.
In this slide, we review
the SailPoint approver approval process.
The supervisor manager provides approval 1.
SailPoint approver receives a CAIA notification email.
The SailPoint approver provides their review,
approval, and/or denial in SailPoint.
The SailPoint approver notifies the supervisor manager
who will then need to notify
the G-Invoicing user administrator to create the new user.
From the home screen in SailPoint,
the SailPoint approver would select the Approvals button.
From there, the SailPoint approver would review the request
by user by SailPoint role request.
The SailPoint approver can review the requestor's comments
per SailPoint role request.
The SailPoint approver could then either approve
or deny per SailPoint role request or blanket approve
with the Approve All or Deny All options.
The SailPoint approver would receive confirmation
of the approval/denial completion as shown in the slide.
The supervisor manager will need to send
two to G-Invoicing user administrator notification
following the SailPoint approver approval completion.
The supervisor manager notification
should include the requestor's identity and email address
and any pertinent information,
including the SailPoint role access
that was requested and approved.
This slide shows any approver's ability
to review all previous approvals created in SailPoint
by either a supervisor manager or a SailPoint approver.
To get to the screen, select My Work tab
in the Work Items option.
Then select the View Archive button.
The approver can then review
many of the previously approved details,
including all of the approvals to date,
including the requestor, SailPoint roles, et cetera.
This slide displays the steps that need to be taken
by the G-Invoicing user administrator
once the supervisor manager and the SailPoint approver
have completed their approval tasks.
The G-Invoicing user administrator will need to follow
new user creation processes in G-Invoicing.
These tasks include new user creation,
adding organizational groups to the new user account,
adding roles to the new user account,
adding user administrator to the new user account,
and additional information such as the username,
email address, and phone number.
Please note, that Treasury offers CBTs
with this specific set of instructions.
Alternatively, you can contact your AIT
for further information
regarding additional CBT instructions.
It should be noted that the Administrator Guides
do contain this type of information
and can be downloaded directly from G-Invoicing help.
This slide provides a detailed view
of the Request for Validation
and SailPoint Requesting Process Flow.
Agencies can request their AIT
to provide a copy of this process
and any G-Invoicing processes.
Users must access G-Invoicing within 120-day period.
At 120 days, SailPoint roles will be stripped
and must be re-requested and re-approved again.
G-Invoicing user administrators
should run G-Invoicing Export Users Report
to gain information on user login activity
and work to users to keep them informed.
CAIA will not be able to send login reminders
as ISIM did previously.
G-Invoicing user administrators
will only need to uncheck the "inactive" box
in G-Invoicing managing users.
Approvers will receive email notification every 24 hours
or until the approval or denials
have been entered into SailPoint
once users have begun the requestor process.
With regard to requestor communication
with their supervisory managers,
the following advisory should be made known.
Supervisor manager approvals
should take approximately 48 hours.
If longer, the requestor should review
the email address provided in SailPoint
for their supervisor manager.
If the supervisor manager email entry
was incorrectly entered,
the requestor should go into SailPoint
and adjust and reset via Modify Manager.
It is also advised that when making SailPoint role requests,
that the requestor add comments
to assist the supervisor manager and SailPoint approvers
in their SailPoint role approvals or denials.
This slide provides details for accessing the TSC,
or Treasury Support Center, for CAIA SailPoint support.
The TSC will be able to provide user identity setup support,
SailPoint and access support,
application approver and requester workflow support,
role and entitlement modifications, existing user support,
and also, any third party CSP required support as needed.
In this demonstration,
we will follow the new user approval processes.
The demonstration will begin with the new user adding
their supervisor manager email address into SailPoint,
followed by the supervisor manager reviewing
and providing their first line approval in SailPoint.
After that, the SailPoint approver will review
and approve the SailPoint role requests.
Lastly, the G-Invoicing user administrator
will create a new user.
So, representing a new user logged in here to SailPoint,
select the hamburger menu,
select Manage Identity, Modify Manager,
and then select Set or Modify the manager for your account.
Selecting Next,
here receive the manager's correct email address.
If this is not correct, the supervisor manager
will not receive notification from CAIA
and anything that the user submits
as far as SailPoint roles will need to be recreated.
So I put that in correctly, and I'll select Next
and then Submit.
Here we're seeing a successful submission
to the supervisor manager.
Here we see the notification
from CAIA to the supervising manager,
and we have a link here as a supervisor manager.
Now, as a supervisor manager, I could select Approvals here
but I'm looking for this specific user,
and I can click on that user there,
which brings me to the initial identity approval
for this specific user that we're looking for
that we just created a request from,
and we can select Approval All here, Deny All.
We also can select approve or deny here
for this specific request,
and we're going to select Approval here.
We'll point out that we can see
the user is now listed under direct reports.
Now, logging back in as the requester,
I select Manage my Access.
I type in some or all of my agency account information,
and then I can look to see different SailPoint roles
that I may request access for, and I'll select Next.
I have the option of adding comments,
and I select Save.
I can then select Submit,
and now this request has been successfully submitted.
Here we see the request to the SailPoint approver.
We see this approval is needed.
We could go to Approvals here as well.
And here, we're acting to review
this SailPoint role request.
We can click here to the comments to review that.
And we can select, approve, or deny.
Now, acting as a SailPoint approver,
providing their approval to this access request.
Again, we can select the comments and approve.
To see the archive, we would select My Work, Work Items.
We can select here to view archive.
Here we see the requestor is getting a notification
that they have all their approvals
but the user administrator in G-Invoicing
has not created their account yet.
Acting as the G-Invoicing user administrator,
I'll select Administration, Manage Users.
We'll select Add New User.
And we will follow the G-Invoicing user creation process.
Select Find, adding in the user information here,
selecting a sample organizational group here.
Chose Select Groups,
bringing down to the assigned groups box
selecting the checkbox here, adding at least one user role,
selecting Apply Roles to Groups and Save.
The new user creation process can be found
in selecting Help, and then Download Administration Guide.
You also can go to the U.S. Treasury's training site
and review additional G-Invoicing CBTs
covering user management, user roles,
and organizational groups within G-Invoicing.
If you need further assistance,
you can always contact your AIT.
For further information on any of the contents of this video
or any G-Invoicing queries,
please reach out to your AIT representative
as listed below in the slide.
This slide displays the Treasury Department
G-Invoicing programing,
noting Andrew Morris as the program manager.
Also, please take note of the methods
to contact G-Invoicing Treasury team listed below.
For example,
to contact the Treasury G-Invoicing team directly,
use IGT@fiscal.treasury.gov.
Thank you for watching this video.