Enhancement
Approvals Migration and Notifications Enhancements: Reminders and Escalations, Regional Routing, and CC:/BCC:
Description
A few months ago, we announced that approvals were migrating to a new service, and that any approvals created before that date would receive an additional 90 days before expiring.
Now that those 90 days have passed, we will begin expiring any remaining pending approvals that have been open for longer than 90 days, starting on August 10, 2026.
As a benefit of completing this migration, you will also receive:
-
A UI for configuring reminders, escalations, and timeouts globally, as well as per access-item
-
Emails will be sent from your region and no longer routed through us-east-1 automatically
-
The ability to configure cc:/bcc: recipients in email templates
Solution
Escalations and Reminders
The approvals service that will now be managing approvals has its own set of configuration options. For convenience and continuity, the configurations you have previously set for access request reminders and escalations will be migrated over to the new service, but there’s more flexibility available if you want to adjust the settings. For example, you can:
-
Set up reminders without escalations
-
Set up escalations without reminders
-
Define the number of escalation levels you want - and even make them go to someone other than the approver’s management chain
-
Define the reminder/escalation cadence with the granularity of a Cron string
-
Define a fallback approver that is an identity or a governance group!
You can configure globally for all approvals except Adaptive Approvals in workflows, or have separate configurations for Access Requests, Entitlement Descriptions, and eventually more.
Go to Admin > System Settings > Feature Settings and you’ll see a new tab for Approval Settings
The same options have been added to the Access Requests section for Entitlements, Access Profiles, and Roles. Global configurations are overridden by any lower-level configuration. For example, a different configuration for a specific Role would override the global config, but the global config would still apply to all other unmodified access items.
Regional Routing of Emails
Identity Security Cloud has added regional AWS SES support for emails. Emails have always been encrypted and sent from your region, but they were all routed and verified through us-east-1. We are migrating all domains to be verified in your primary region.
Please note that we will skip automatic migration for any domains which have custom MAIL FROM configured to ensure there are no issues with emails being blocked by your SMTP servers. Those of you in this case will need to re-add/re-verify your domain in your primary region.
-
All email addresses and domains now carry an AWS region alongside the address/domain (if the region is not visible, please refresh the page).
-
New identities (email addresses and domains) are created and verified in your tenant’s primary region.
-
Existing identities continue to function and are treated as
us-east-1until they are removed and re-verified. -
Emails are always sent from the region in which the email address or domain is verified (currently all emails are sent via
us-east-1infrastructure). -
A
regionfield has been added toEMAIL_SENTaudit events, reflecting the AWS region used to send the email.
What does not change
-
Existing verified email addresses and domain addresses will continue to send emails from the
us-east-1region. -
Identities (email addresses and domains) in a pending verification state will continue to be verified in the region where they were originally added.
Migrating existing identities to your primary region
If you wish to leverage your tenant’s dedicated regional email infrastructure rather than the us-east-1 routing, you will need to migrate existing identities. To determine which identities require action, check the region displayed next to each email address or domain in the UI.
-
Email addresses: If the region label shows
us-east-1, remove and re-add the address to trigger verification in your primary region. The same email address may be re-added — it will replace the existing record and trigger a new verification email for the primary region. -
Verified domains: Domains that were in a Verified state and did not have any MAIL FROM attributes configured prior to this rollout will be automatically migrated to your primary region
We recommend re-adding the same email address or domain without removing it first — the new entry will replace the existing record and trigger the verification in primary region automatically.
No action is required if you are satisfied with your current us-east-1 email routing.
Also, only verified domains are migrated to the primary region automatically. Sender email addresses must be removed and re-verified manually.
Migration of verified domains should be automatic. However, if your verified domain is still labeled with the us-east-1 region after migration, please remove and re-verify it to complete the transition.
CC:/BCC: Support
Email templates now support configuring CC:/BCC: recipients from Manager, Identity, Governance Groups, Org Admins, and/or a static email address.
The following templates are restricted from using CC:/BCC: recipients for security reasons.
cloud_user_password_expiration
cloud_user_password_reset_token
cloud_user_unlock_token
cloud_user_verification_token
onboarding_password_reset
Who is affected?
All customers
Important dates
Sandbox availability: Aug 3, 2026
Production rollout: Aug 10, 2026 - Aug 13, 2026
