Auto approve Access request Instantly in workflow

Identity Security Cloud (ISC) ISC Discussion and Questions
,
5

Hello Sandy. You don’t need an Approval Policy step in this workflow. That action is designed for Adaptive Approvals, it creates a new review item and the workflow pauses until a reviewer acts on it. That’s why your workflow gets stuck. Remove it.

What @sushantkulkarni is describing is a different approach. When your workflow submits the access request, the Global Approval Policy creates a pending approval in the background. You then use the same workflow to find that pending approval and approve it programmatically, no extra workflow needed.

Here’s how to set it up step by step:

  1. Keep your Submit Access Request step. The create-access-request API is asynchronous, so the workflow moves on immediately after submitting. The response contains the access request ID inside the newRequests array, specifically at newRequests[0].accessRequestIds[0]. Both newRequests and accessRequestIds are arrays, so multiple identities or access items will produce multiple IDs. Grab that value, you’ll need it in step 3.
  2. Add a Wait step, at least 1 minute. ISC needs time to process the request and generate the approval record from the Global Approval Policy. Without this, the approval won’t exist yet when you try to retrieve it.
  3. Add a Get Pending Access Requests step. Select the identity who currently owns that approval (e.g., the manager or access item owner defined in your Global Approval Policy) as the Reviewer, then apply this filter using the accessRequestId from step 1: accessRequestId eq "<your-access-request-id>". The list-pending-approvals endpoint supports accessRequestId as a filter, so this pulls only the approval tied to your specific request instead of everything in the queue.
  4. Add an Approve Access Request step. Use the Variable Selector to pass the id from the first record returned in step 3. This is the approvalId, which is different from the accessRequestId you used to find it. The accessRequestId identifies the overall request, the approvalId identifies the specific approval record you’re acting on.

If your Global Approval Policy has multiple levels (e.g., manager then governance group), repeat the Wait, Get Pending, Approve sequence for each level and select the appropriate reviewer for that level. The next level’s approval only gets created after the previous one is approved.

The identity performing the approval must either be the current approval owner or have the ORG_ADMIN user level. If the approval isn’t showing up when step 3 runs, increase the Wait duration and check the workflow execution logs.