title: Violation Remediation category: Policies tags: violations, remediation, automation, actions, workflow priority: Normal

Violation Remediation

When policies detect issues in your environment, violations are created. This article covers how to view, manage, and remediate violations in IdentityCenter -- from manual investigation through fully automated responses.

Violation Management

Accessing Violations

Navigate to Governance > Policies, then click any policy to see its violations at /admin/compliance/policies/{id}/violations. You can also view all violations across all policies from Governance > All Violations.

Violation List View

The violations page displays all detected issues for the selected policy:

Violation Statistics

At the top of the violations page, summary statistics provide a quick health check:

Violation Statuses

Each violation moves through a lifecycle:

Status Transitions

Open --> Acknowledged --> Remediated --> Closed
 |                                        ^
 |                                        |
 └--> Ignored              (auto-closed when condition clears)

Violations in Remediated status are automatically moved to Closed when the next policy evaluation confirms the condition no longer exists. If the condition recurs, a new violation is created.

Manual Remediation

Investigating a Violation

1. Click the violation to open its detail view
2. Review the violation context:
   • Which object is affected
   • What condition was detected
   • When it was first and last detected
   • Severity level and policy description
3. Click the object link to navigate to the full detail page for additional context

Taking Manual Action

From the violation detail view, you can take direct action:

After taking an action, update the violation status to Remediated. The next policy evaluation will confirm whether the condition is resolved and move the violation to Closed automatically.

The ViolationAction Component

The ViolationAction.razor component provides the UI for taking action on individual violations. It displays the available actions based on the violation type and the current user's permissions, and it confirms each action before execution.

Automated Remediation Actions

When configuring a policy, you can assign automated actions that execute immediately when a violation is detected.

Available Automated Actions

Combining Actions

You can configure multiple actions for a single policy. They execute in sequence:

Example: Stale Admin Account Policy
  1. Log Only (always)
  2. Send Alert to security-team@company.com
  3. Create Ticket in ServiceNow (Priority: High)
  4. Disable Account (after 14-day grace period)

The RemediationService

The RemediationService is the backend service that executes automated remediation actions. It:

• Receives violation details from the policy evaluation engine
• Determines which actions to execute based on the policy configuration
• Calls the appropriate service for each action (email service, ticketing API, write-back service)
• Logs the result of each action in the audit trail
• Updates the violation status to Remediated on success

AD Write-Back for Remediation

High-impact actions like Disable Account, Remove from Group, and Force Password Reset use the IObjectWriteBackService to make changes directly in Active Directory.

How Write-Back Works

1. The RemediationService calls IObjectWriteBackService with the requested change
2. The ObjectWriteBackService implementation connects to AD using the configured service account credentials
3. The change is applied in AD via LDAP
4. A ChangeAuditLog entry is created recording who/what initiated the change, the old value, and the new value
5. The violation is updated to Remediated status

Audit Trail

Every write-back action creates a complete audit record:

Write-Back Caller Context

For automated remediation actions that run without an HTTP context (background jobs, scheduled policy evaluations), the system uses WriteBackCallerContext.System("PolicyRemediation") to identify the source in audit logs.

Approval Workflows for Remediation

For high-impact remediation actions, you can require approval before execution.

When to Require Approval

Configuring Approval Requirements

1. Edit the policy
2. In the Actions section, select an action that supports approval
3. Enable Require Approval
4. Select the approver: the user's manager, a specific person, or a group
5. Set the approval timeout (what happens if no one approves within the deadline)

When approval is required, the action is queued but not executed. The approver receives a notification and can approve or reject the action. See Workflow Designer and Approver Resolution for details on the approval workflow.

Risk Acceptance (Ignoring Violations)

Sometimes a violation represents an intentional configuration. For example, a break-glass admin account may legitimately have "Password Never Expires" set.

How to Accept Risk

1. Open the violation detail view
2. Click Ignore / Accept Risk
3. Enter a justification comment explaining why this violation is acceptable
4. Optionally set an expiration date for the acceptance (forces re-evaluation later)
5. Confirm

Risk Acceptance Best Practices

Remediation Strategy: Graduated Approach

The recommended approach for new policies is to start conservatively and increase automation over time.

Phase 1: Observe (Weeks 1-2)

Phase 2: Alert (Weeks 3-4)

Phase 3: Automate (Week 5+)

Important: Never jump directly to automated account disabling for a new policy. False positives in a "Disable Account" action can lock out legitimate users and cause business disruption.

Next Steps

• Policies Overview -- Understand the policy framework
• Built-In Policies Reference -- Complete list of pre-configured policies
• Creating Policies -- Build custom policies
• Lifecycle Management -- Automate identity lifecycle actions
• Object Write-Back -- How AD changes are made
• Workflow Designer -- Configure approval workflows for remediation
• Access Reviews -- Use "Flag for Review" to route violations into access reviews
• AI Chat -- Ask questions about violations in natural language