Skip to main content

​
Background

Access Policies control who gets access to what, so changes to a live policy carry risk. You can create a draft from any published Access Policy, change it, and publish it when it is ready. The published version stays in effect the whole time. Published policies can’t be edited in place. Every change goes through a draft first.

​
When to use a draft

  • Rework conditions on a live policy. Change who a policy applies to (job title, department, employment type) without a half-finished condition set going live.
  • Add or remove apps and permissions. Stage the new app list, review it with the app owner, then publish once.
  • Get a review before a change takes effect. The policy owner builds the draft and moves it to Ready to Publish. An Admin reviews and publishes it.
  • Collaborate on a change. Comment on the draft and share it with stakeholders while the current version keeps running.

​
Prerequisites

  • You are an Admin or the owner of the policy.
  • The policy is already published. New policies start as drafts on their own.
  • Only Admins can publish a draft.

​
Create a draft

  1. Go to Access Policies and open the published policy you want to change.
  2. Click the “Create Draft” button in the top right.
    The Create Draft button on a published Access Policy
  3. Lumos opens the draft. A banner at the top reads This is a draft of an existing policy. with a View Published link back to the live version.
    The draft banner with the View Published link
  4. Edit the draft. You can rename it, update the “Business Justification” field, edit Conditions, or add and remove apps under Apps & Permissions.
  5. Click “Save”.
Your changes don’t affect anyone yet. The published version stays in effect until the draft is published.

​
Publish a draft

  1. As an Admin, open the draft and click the “Publish Policy” button.
    The Publish Policy button on a draft
  2. Lumos checks the draft’s conditions for uniqueness against other published policies. It then replaces the published version with the draft.
A draft moves from Work in Progress to Ready to Publish before it can be published. It can’t skip straight from Work in Progress to published. To discard a draft, click “Discard Changes”. The published version doesn’t change.

​
Frequently asked questions

Can I edit a published policy directly? No. Create a draft first. Does the policy stop working while a draft exists? No. The published version stays in effect (if it is active) until the draft is published. Can I have more than one draft of a policy? No. Each policy can have one draft at a time. Can I see or restore old versions of a policy? No. What happens to the old version when I publish a draft? The draft replaces it and becomes the published, enforced version. What if my draft’s conditions overlap with another policy? Lumos checks for overlap at publish time, against other published policies. The policy’s own current version doesn’t block its draft. Can I comment on or share a draft? Yes. Sharing a draft shares the policy in both its draft and published states.