Access Request Approval Escalation

Identity Security Cloud (ISC) ISC Discussion and Questions
,
1

:bangbang: Please be sure you’ve read the docs and API specs before asking for help. Also, please be sure you’ve searched the forum for your answer before you create a new topic.

Hey, is it possible to escalate the request after n days directly to a Governance Group/Static Identity without escalating it to previous approvers’ manager?

when I tried passing escalationChain as an emptyArray[], ISC added this chain by default.

image
image506×477 17.9 KB

Also when I tried passing an static identity in chain, it gave a response like this

{  “detailCode”: “Bad Request”,  “trackingId”: “29ff92572cf548d3a2e46d85cca14e9f”,  “messages”: [    {      “locale”: “en-US”,      “localeOrigin”: “DEFAULT”,      “text”: “Validation error, Message: Escalation chain only supports MANAGER_OF tiers until migration is complete”    }  ]}
2

Hi @akshatt25

No, you cannot use escalationChain to escalate directly to a Governance Group. If the assigned approver doesn’t take action within the configured time limit, ISC escalates the request through MANAGER_OF levels first, and only after those are exhausted does it go to the fallbackApprover, which can be an individual or a governance group. That is why an empty escalationChain still gets manager tiers added, and why you receive the error saying only MANAGER_OF tiers are supported until migration is complete.

Thanks

3

Hi @akshatt25

Please check this , as this could be useful to your case. This recent announcement mentions about the advanced approval flow which is more flexible. Although, I have not tried it but i did see a section for escalation matrix in the approval-config API which may let you achieve it.

Something worth exploring for your in your case. Although this does mean that you will have to move to newer approver policy but it does come up with some features which would be helpful in your case.

Please check this and keep us updated if it helps.

Regards
Vikas.

4

Hey, thanks for replying can we escalate it to a static identity without manager being in chain i.e. identityType:“MANAGER_OF”

5

No, you can’t escalate directly to a static identity through escalationChain without identityType “MANAGER_OF”. If the approver does not act within the configured time, it escalates to the manager of the assigned reviewer through configured MANAGER_OF levels then, if no more escalation levels are available, it goes to the fallback approver, which can be an individual/static identity or governance group. Here you can configure static identity as the fallback approver.

Thanks