OneLogin - How to Generate a Detailed Report with Application Managers Privilege Users and Apps (4383498)

There is a need to generate a report listing:

• Applications
• Their associated administrators (users with app management privileges)
• Relevant privilege assignments

However, the available reports either:

• Display role assignments instead of actual privileges, or
• Include excessive data (such as roles and unrelated privileges), making it difficult to isolate application administrators

Additionally, there is no out-of-the-box report that directly correlates applications with their specific administrators.

The issue occurs due to the following platform limitations and behaviors:

1. Report Structure Limitations

   • Standard reports cannot be modified and may not include the required combination of attributes. [Knowledge...er Support]
   • Custom reports do not support flexible filtering logic (e.g., OR conditions in privilege filters), which restricts precise data extraction. 

2. Privilege Data Complexity

   • Privileges (such as Manage Applications or Manage Roles) are assigned separately and may overlap for the same user.
   • A user with multiple privileges may appear in reports with unrelated entries (e.g., role-related privileges mixed with app privileges). 

3. Reports vs. Roles Confusion

   • Some exported reports only reflect role assignments rather than actual privilege-based access. 
   • Privileges that reference roles or apps may have similar naming conventions, making them difficult to distinguish programmatically. 

4. No Direct Mapping Between Apps and Admins

   • OneLogin does not provide a native report that directly maps applications to their administrators.

To obtain a reliable list of application administrators, follow the process below:

Step 1: Use the “Privileged Users” or Custom Privilege-Based Report

• Generate or modify a report that includes users with the Manage Applications privilege
• Ensure the report includes relevant columns such as:
  • User
  • Privilege name
  • Associated object (App, Role, etc.)

Step 2: Reduce Noise in the Report

• Filter results to focus on:
  • Privileges containing Manage Applications
• Be aware that:
  • Other privileges (e.g., Manage Role, Super User) may still appear due to reporting limitations

Step 3: Export Required Reports

Export at least two datasets:

1. Privilege-based report (users and their privileges)
2. Applications report (list of all applications)

• The Applications report provides the authoritative list of valid app names
• The privilege report includes potential matches but may contain roles and unrelated entries

Step 4: Correlate Data in Excel

• Use a lookup function (e.g., XLOOKUP) to compare privilege names against application names
• Match privilege entries that correspond exactly to application names
• Exclude non-matching entries (these are typically roles or unrelated privileges)

Step 5: Validate Results

• After correlation:
  • Each matched entry represents a user managing a specific application
• Optional:
  • Group results by user to identify users managing multiple applications
  • Filter applications without assigned administrators

Step 6: Alternative Approach

• Clone and adjust reports to isolate other privileges (e.g., Manage Role) if needed
• Submit a feature request if a consolidated report is required, as this capability is not currently native