We are trying to configure approvals for SNOW catalog requests where the approval scheme is defined at the access item level (manager, owner, governance group, etc.), but the approvals should be completed in ServiceNow.
Currently, we have selected “Configurable Approvals” under approval flow and enabled “Generic Approval Definition Enabled”. We have also created an approval rule with “Identity Security Cloud Workflow” as the approval type; however, the approvals are getting skipped.
We have set “approvalsMustBeExternal”, but based on the expected behavior, we understand that for “Identity Security Cloud Workflow”, this flag should be set to false.
Could you please confirm if this is the correct configuration? Also, if the approvals need to be handled entirely in ServiceNow, should we instead use ServiceNow-specific approval rule types?
That is correct - ISC Workflow as an approval rule will submit the access request in ISC, approvals will be generated and fed back into ServiceNow. Once they are completed, it will reassign the approvals in ISC to the servicenow user and approve them.
approvalsMustBeExternal needs to be false if you want to use ISC Workflow because if it’s true, no approvals will be generated in ISC
Thank you for responding.
The user will be submitting the request in ServiceNow and approvals needs to be completed in servicenow based on the approval configuration set on the access profile in ISC. We do not want any approval to happen in ISC so we set it as true.
The approvals aren’t really “happening” in ISC - they are essentially being “copied” into ServiceNow then updated in ISC based on the result of the ServiceNow approal.
If you want to use ISC Workflow as your approval rule, you cannot also have approvalsMustBeExternal set to true. If you want to have it set to true, you need to write your own Approval Rule on the ServiceNow side using the ServiceNow script option, scrape the approval scheme from the item, and send the approval users back.
We changed it to false. However, now approval got generated in Sailpoint ISC. Please find below snow request and approval definition we have set. Please let me know if you have any thoughts on this.
It is expected behavior if your approval rule is ISC Workflow. It will create approvals in ISC, then copy them over to ServiceNow. The approval result in ServiceNow for each approval stage will be replicated over to ISC, and the process will repeat until all approval stages are complete
Thank you @mcheek , its working as expected. We had some data issues which it was not working as expected.
We are also evaluating a use case where manager approval should be automatically approved when the manager is the person submitting the request on behalf of a user.
To support this, we configured the connection in ServiceNow to “User Account Configuration” and set auto approvalflag to Direct in SailPoint. This successfully addressed the manager auto-approval scenario. However, we would like to revert the connection back to “Service Account Configuration”, as the current setup introduces an additional login prompt.
Is there a way to achieve the same manager auto-approval behavior while using “Service Account Configuration” without changing the approval rule from “ISC Workflow”?
Basically, our use case is that when an access profile with Manager as the approver is requested by a manager on behalf of their subordinate through the ServiceNow catalog, the manager approval should be automatically approved or skipped in SailPoint.
We would like to retain the connection configuration as Service Account Configuration. Is there a way to achieve this behavior while continuing to use “ISC Workflow” as the approval rule in the SailPoint-ServiceNow Catalog integration, or should we change the approval rule to a ServiceNow Workflow/Flow and implement custom logic to handle this scenario?
You can set up a business rule on the servicenow side to automatically approve sysapproval_approver records where the attached record opened_by field matches the approver field
