Create reminders using access request config

Identity Security Cloud (ISC) ISC Discussion and Questions
, ,
1

Hello everyone,
I would like to create reminders for approvers so requests are not pending approval for days. Currently, it looks like by default, no reminders are sent. Reference - API to set global reminders and escalation policies for access request approvals - Compass

Looking at the access request api doc - set-access-request-config | SailPoint Developer Community

This is our current setting:

{
	"approvalsMustBeExternal": false,
	"autoApprovalEnabled": true,
	"reauthorizationEnabled": false,
	"requestOnBehalfOfConfig": {
		"allowRequestOnBehalfOfAnyoneByAnyone": true,
		"allowRequestOnBehalfOfEmployeeByManager": false
	},
	"approvalReminderAndEscalationConfig": {
		"daysUntilEscalation": null,
		"daysBetweenReminders": null,
		"maxReminders": null,
		"fallbackApproverRef": null
	},
	"entitlementRequestConfig": {
		"allowEntitlementRequest": true,
		"requestCommentsRequired": false,
		"deniedCommentsRequired": false,
		"grantRequestApprovalSchemes": null,
		"revokeRequestApprovalSchemes": null
	},
	"govGroupVisibilityEnabled": false
}

If I need to just enable reminders do I need a put request with the below?

{
	"approvalsMustBeExternal": false,
	"autoApprovalEnabled": true,
	"reauthorizationEnabled": false,
	"requestOnBehalfOfConfig": {
		"allowRequestOnBehalfOfAnyoneByAnyone": true,
		"allowRequestOnBehalfOfEmployeeByManager": false
	},
	"approvalReminderAndEscalationConfig": {
		"daysUntilEscalation": null,
		"daysBetweenReminders": 1,
		"maxReminders": 3,
		"fallbackApproverRef": null
	},
	"entitlementRequestConfig": {
		"allowEntitlementRequest": true,
		"requestCommentsRequired": false,
		"deniedCommentsRequired": false,
		"grantRequestApprovalSchemes": null,
		"revokeRequestApprovalSchemes": null
	},
	"govGroupVisibilityEnabled": false
}

Somewhere I read that just reminders don’t work and I have to add “daysUntilEscalation” as well. Can someone confirm expected behavior?

Thank you

2

Might have the answer in this post - Remove the Escalation of access request - #16 by SailorKev

3

hi if you want to send a reminder to approver everday then you can use the below snippet.

{
	"approvalsMustBeExternal": false,
	"autoApprovalEnabled": true,
	"reauthorizationEnabled": false,
	"requestOnBehalfOfConfig": {
		"allowRequestOnBehalfOfAnyoneByAnyone": true,
		"allowRequestOnBehalfOfEmployeeByManager": false
	},
	"approvalReminderAndEscalationConfig": {
		"daysUntilEscalation": 2,
		"daysBetweenReminders": 1,
		"maxReminders": 3,
		"fallbackApproverRef": null //You also need to set this if you want to fallback after the escalations are completed
	},
	"entitlementRequestConfig": {
		"allowEntitlementRequest": true,
		"requestCommentsRequired": false,
		"deniedCommentsRequired": false,
		"grantRequestApprovalSchemes": null,
		"revokeRequestApprovalSchemes": null
	},
	"govGroupVisibilityEnabled": false
}

Yes daysUtilEscalation needs to be set to start the reminders to approver. So with the above config the below flow of email notifications would be triggered.

Day Action Escalation or Reminder
0 An initial email is generated asking the designated approver to review the request NA
1 No reminder NA
2 No reminder NA
3 An email is sent to the approver after the period defined in daysUntilEscalation First reminder
4 An email is sent to the approver Second reminder
5 An email is sent to the approver Final reminder
6 An escalation email is sent to Approver 2 (line Mgnr) First escalation
7 An email is sent to Approver 2 First reminder
8 An email is sent to Approver 2 Second reminder
9 An email is sent to Approver 2 Final reminder
10 An escalation email is sent to Approver 3 (2nd line Mgnr) Second escalation
11 An email is sent to Approver 3 First reminder
12 An email is sent to Approver 3 Second reminder
13 An email is sent to Approver 3 Final reminder
14 An escalation email is sent to the fallback approver Final escalation
15 No further emails are sent; request is waiting with fallback approver —

To update this you have to use this endpoint Update access request configuration

4

Thank you. I wanted to clarify a few items. Reading your config, does the reminder start on the 2nd day after the initial email is generated (daysuntilescalation)? The second reminder will be sent on the 3rd day defined in daysbetweenreminders and upto maxreminders of 3?

5

No the first reminder starts on 3rds. I considered the initial notification as 0th day. So to clarify you if a request is raised today then next two days there will not be any reminders on 7th July first reminder will be triggered.
On your second question yes second reminder depends on daysBetweenReminders and the count of reminders depend on maxReminders.
I hope this clarifies you.