Access request escalation not working as expected

Identity Security Cloud (ISC) ISC Discussion and Questions
,
1

Hi Everyone,

We are trying to set the access request escalation configuration. We want the first approver to be the manager, if the manager doesn’t respond after X days, the access request is passed on to the manager’s manager. If he/she still doesn’t respond after X days then the access request is denied. Instead, if the access request gets approved it must continue the original path (e.g. to object owner).

We’ve tried playing with the set-access-request-config api but with no success, this is our config as of now:

{
    "approvalsMustBeExternal": false,
    "autoApprovalEnabled": false,
    "reauthorizationEnabled": true,
    "requestOnBehalfOfConfig": {
        "allowRequestOnBehalfOfAnyoneByAnyone": true,
        "allowRequestOnBehalfOfEmployeeByManager": false,
        "allowRequestOnBehalfOfForMachineIdentity": false
    },
    "approvalReminderAndEscalationConfig": {
        "daysUntilEscalation": 1,
        "daysBetweenReminders": 0,
        "maxReminders": 1,
        "fallbackApproverRef": {
            "email": "example@mail.com",
            "type": "IDENTITY",
            "id": "0000000001",
            "name": "example_name"
        }
    },
    "entitlementRequestConfig": {
        "allowEntitlementRequest": true,
        "requestCommentsRequired": false,
        "deniedCommentsRequired": false,
        "grantRequestApprovalSchemes": null,
        "revokeRequestApprovalSchemes": null
    },
    "govGroupVisibilityEnabled": false,
    "fallbackAccessDurationInDays": null
}

I have also set up the access request config for each role as:

image
image587×811 22.4 KB

Any help is greatly appreciated!

2

Hey @Pol1 !

Without knowing exactly what you are seeing happen, beyond what you are expecting to happen, I am thinking the problem is with your 0 value for daysBetweenReminders. This article helps explain the config in a bit more detail, most notably this section:

IMPORTANT: Specifying a value of 0 for any of these escalation policy parameters will generate the following results:

daysTillEscalation No reminder will be sent and no escalation will occur
daysBetweenReminder After first reminder, no additional reminders will be sent and no escalation will occur
maxReminders No reminder will be sent before escalation

Additionally, SailPoint just announced last Friday a change to how escalations and reminders are handled (among some other additional features). As far as I understand it, you can still use the previous config settings with the set-access-config api, but if you want to take advantage of these new features, you should look to use this new API endpoint when it is (expected) to release during the week of 2/23/26. It might be worth just looking to utilize the new endpoint instead of setting the config on the old endpoint, but that is entirely up to you! Just note, the article indicates, “once you choose to take advantage of the new features, you must discontinue use of these earlier access-request-config endpoints."“

Please let me know if this helps!

  • Zach
3

Hey Zach!

thank you for your answer! I wasn’t aware of the new API coming out so I’ll definitely use that :).

4

Hello Zach!

I’ve checked out the new API for the escalation config in access requests. I don’t find how to choose the specific workflow the approval must follow. I understand it’s using the escalationChain object, but how do I choose this? What I want specifically is 1st manager, 2nd manager and then fallback.