To require approvals for requested access, an administrator must create request approval policies. Identity Governance provides a default request approval policy. Users with the Customer, Global, or Access Request Administrator authorization can either edit the default policy and configure it for auto-approval based on specific conditions. They can also create new request approval policies to further define the approval policies for various situations.
If there was an auto-approval based on conditions, that auto-approval will show up in the request timeline, and it will show why it was auto-approved. You can configure automatic approval and automatic denial at the policy level and at the approval step level.
Criteria in the conditions are not limited to the recipient. A request has a recipient, a resource (such as a permission, technical role, or application), and a requester. The criteria can be any combination of attributes of the recipient, requester, and resource. If the resource is a permission, criteria can also be the application to which the permission belongs. Approval conditions for approval steps can also include attributes of the approvers.
The out-of-the box default approval policy does not require approval, so requests for permissions, technical roles, and applications associated with the default approval policy are not routed through any approval workflow, but are sent directly to fulfillment. For an approval policy that does not require approval, the request timeline will not show any approval as having occurred. It will simply show that the request items were sent directly to fulfillment.
To configure the default request approval policy:
In Identity Governance, select Policy > Access Request.
On the Approval Policies tab, click Edit to edit the default approval policy.
(Optional) Edit the name of the policy.
(Optional) Configure automatic approval or denial at the policy level.
Add one or more approval steps, depending on how many levels of approval you require. For each approval step:
(Optional) Configure automatic approval or denial at the approval step level.
Specify approvers.
NOTE:You can use self, recipient supervisor, item owners, users, groups, or coverage maps or workflow to specify approvers. For information about coverage maps, see Using Coverage Maps. For information about workflows, see Section 21.7, Using Workflows to Approve Requests.
View notification emails, and optionally set reminder email frequency and add recipients
Set escalation period and specify escalation approvers
Set expiration period and assign default action at the end of the expiration period
Add or remove applications, permissions, and technical roles assigned to the policy.
Save the policy.
To create additional request approval policies:
In Identity Governance, select Policy > Access Request.
On the Approval Policies tab, click + to add an Access Request approval policy.
Type a name for the policy.
(Optional) Configure automatic approval or denial at the policy level.
Save the policy.
Assign applications, permissions, and technical roles to the policy.
You can configure an access request approval policy at the approval policy level to:
Automatically approve requests matching specified conditions
Automatically deny requests matching specified conditions
Automatically approve requests matching one set of specified conditions while denying requests matching another set of specified conditions
Automatically approve requests where the resource is authorized to the recipient by one or more business roles
To configure automatic approval and denial at the approval policy level:
In Identity Governance, select Policy > Access Request.
On the Approval Policies tab, click + to add an Access Request approval policy.
Enter a name for the policy.
Select one of the following conditions for auto approve, auto deny, or both:
None (Disables the feature)
For Grant requests (Requests to add a permission, a technical role, or an application)
For Revoke requests (Requests to add a permission, a technical role, or an application)
For Grant and Revoke requests (For all requests)
NOTE:Identity Governance applies the condition only to requests of the specified type.
Use the Expression Builder to specify the conditions for automatic approval or denial. For more information see Section 4.1, Using the Expression Builder to Create Advanced Filters.
Save the policy.
As mentioned earlier, in addition to settings auto approval via conditions, administrators can also set automatic approval for resources that are authorized for the recipient by one or more business roles. Administrators can set this option also either at the policy level or at the approval step level. Identity Governance automatically approves a request if the system submits a request for a user, and a business role authorizes the resource for that user.
If you choose to automatically approve a request by business role at the policy level, the choice is no longer available at the approval step level. Automatic approval by business role configured at the approval policy level ends the process, and does not get routed to the approval step level, so approval by business code at the approval step level is not needed. In addition, if a condition fails the test for approval by business role at the approval policy level, it would also fail at the approval step level, so automatic approval by business role at the approval step level is redundant.
To configure automatic approval by business role at the policy level:
In Identity Governance, select Policy > Access Request.
On the Approval Policies tab, click + to add an Access Request approval policy.
Type a name for the policy.
Select one of the following conditions for Auto approve items authorized by business role.
No (Disables the feature)
For Grant requests (Requests to add a permission, a technical role, or an application)
For Revoke requests (Requests to remove a permission, a technical role, or an application)
For Grant and Revoke requests (For all requests)
Save the policy.
An access approval policy could need additional approval steps if the access is not authorized by company business policies. Configuring automatic approval at the approval step level allows an administrator to configure the approval policy to skip an approval step under specified conditions, but require approval for any subsequent approval steps.
A request approval policy can be configured at the approval step level to:
Automatically approve requests matching specified conditions
Automatically approve requests authorized by business roles
To configure automatic approval at the approval step level:
In Identity Governance, select Policy > Access Request.
On the Approval Policies tab, click + to add an Access Request approval policy.
Type a name for the policy.
On the Approvals tab, click +.
Click the approval step, then click Approvers.
Select one of the following for Auto approve condition:
None (Disables the feature)
For Grant requests (Requests to add a permission, a technical role, or an application)
For Revoke requests (Requests to remove a permission, a technical role, or an application)
For Grant and Revoke requests (For all requests)
Use the Expression Builder to specify the conditions for automatic approval. For more information see Section 4.1, Using the Expression Builder to Create Advanced Filters.
Select an approver.
(Optional) Add more approval steps.
Save the policy.
To configure automatic approval by business role only at the approval step level:
In Identity Governance, select Policy > Access Request.
On the Approval Policies tab, click + to add an Access Request approval policy.
Type a name for the policy.
Do not select Auto approve items authorized by business role at the policy level.
NOTE:If you select Auto approve items authorized by business role at the policy level, you cannot enable it at the approval step level.
On the Approvals tab, click +.
Click the approval step, then click Approvers.
Select one of the following conditions for Auto approve items authorized by business role.
No (Disables the feature)
For Grant requests (Requests to add a permission, a technical role, or an application)
For Revoke requests (Requests to remove a permission, a technical role, or an application)
For Grant and Revoke requests (For all requests)
Select an approver.
(Optional) Add more approval steps.
Save the policy.
After you have created request or approval policies, you can assign resources to them, such as applications, permissions, and technical roles. Note that adding application to a policy does not automatically include the application permissions. To request permissions and to require approval for permission requests, you must also assign the permissions to the policy.
In Identity Governance, select Catalog > Applications, Permissions, or Roles.
Select the applications, permissions, or roles.
In Actions, select the option you want. You can:
Assign access request policy
Remove access request policy
Assign approval policy
You can also import assignments, assign resources to a policy, or remove resources from a policy while editing the policy definition.
(Conditional) If you have an assignments file that you had chosen to export when exporting a access request policy, click Import Assignments in the policy details page to import assignments.
NOTE:If you import more than the preconfigured threshold for assignments, you cannot import assignments using the assignments file and will need to import the policy from the policies list page.
Alternately, assign resources.
Select the Applications, Permissions, or Roles tab.
Select + under the tab to select resources of the specific type to assign to the policy.
(Optional) Specify if a request for a technical role access should be approved at the role level or at the individual permission level.
Select one or more technical roles.
Select Actions > Set Role Level Approval to enable approval of all requests for permissions included in the technical role as a group.
Or
Select Actions > Set Permission Level Approval to enable approval of each permission included in the technical role individually.
Select the resources to be removed using the check box next to the ones you want to remove.
Select Remove to remove the selected resources.
NOTE:You cannot remove resources from the default approval policy in this way. A resource can only be removed from the default approval policy by assigning it to another approval policy. Also, removing a resource from a policy other than the default approval policy will re-assign the resource to the default approval policy.