This enhancement is brought to you by
Idea GOV-I-1764
Description
We are pleased to announce the release of two new configuration options to help your organization manage your least privilege requirements: mandatory end dates and max duration.
The Details
Configuration
On a per-requestable-item basis, admins can now configure end date requirements for access requests. You can specify when end dates are mandatory, as well as the maximum allowable time period a user can request access for.
At the time of request, the Request Center will enforce these requirements, prompting the requester to provide an end date for the access and, per the configuration, constraining the allowed date/time that can be specified.
That’s right – time! You can specify a max duration of hours, days, weeks, or months. And for cases where a date is required but hard enforcement of a specific duration is not possible, you can omit max duration and leave it to your approvers to determine if the entered end date is appropriate for the specific user.
Important notes:
- Particularly when specifying max durations in units of hours, you should take into account that durations are enforced from the moment of request, and any required approvals will consume some of that duration.
- Max durations will not be applied to existing assignments. However, any future changes to existing assignment dates will have to comply with the max duration.
- Example: Bob has access to entitlement X expiring in 45 days. The admin adds a max-duration requirement to entitlement X of 30 days. If Bob tries to extend his access on the last day (45 days from now), he would be able to request another 30 days. But if he tries to extend his access today, he would only be eligible to shorten his access (to 30 days from now), since his current access is not in compliance with the new requirements.
Enforcement in Access Requests
At the time of request, the requester will be able to select any end date and time for the revocation that complies with the defined requirements, if any. The page will default the time zone to the requester’s browser time zone, but they have the ability to override that if they prefer to specify the revocation time in another time-zone context.
To simplify the user experience, we have merged the end date and comments fields onto one overlay so users can provide any or all required values at the same time.
Note: Requesters don’t need to shift time zones for the benefit of the requestee or approver – the UI will automatically display the end time in the viewer’s browser time zone on pages like the approval page or the My Access page.
Date Changes
Assignment end dates can be altered as needed after the access has been provisioned.
- Users can request a new end date (extension or shortening) for themselves on the My Access page.
- Managers can request end date changes on the My Team page.
- Admins and Access Revokers can adjust end dates on the Admin > Identities > Access page.
All date-change requests must also comply with any specified end date / max duration requirements, enforced from the moment of the date-change request.
In addition, these UI pages also now support the ability to add an end date where one was not previously requested or to remove an end date where one was previously applied. All date change requests will go through the configured approvals before being applied.
Approval Adjustment
We have made a couple of adjustments to the approval flows for date changes.
- We made it more obvious to the approver that they are approving a date change, not a new access request. They’ll now see a Modify operation as well as a marker on the approval card that shows it is an Access Date Change approval, and the prior end date will be shown alongside the new end date.
- Until now, any date change always went through approval as if it were an add-access operation. When a user has requested to shorten access (adding an end date where one did not previously exist or moving an end date earlier), we will now apply the revocation approval requirements configured for the item. If you have not configured the separate revocation approval requirements, that will mean no approval is required for the early release of access.
Date Change through Re-Request
As before, users can also request an access date change by submitting a new request for the access with a different end date through the Request Center. Since Request Center is not contextually aware of existing assignments, all requests submitted this way – even those that shorten the duration – will be processed under the add-access approval flow, but the approver will still see that the request is for a date change and will see both the old and new end dates in the approval details.
Workflow and API Enforcement
To support continuity for automated processes that may not be aware of these new configurations and to proactively enforce them, we have implemented backend guardrails to avoid failing requests that are missing required end dates.
- For items with a configured max duration: Any workflow or API submitted request which contains no end date will automatically be amended to include an end date that corresponds to the configured max duration. We won’t be changing submitted end dates, so requests submitted with an end date that violates the max duration will fail validation.
- For items with a mandatory end date but no max duration: We are adding a fallback duration attribute (
fallbackAccessDurationInDays) in the access-request-config that admins can use to define a duration to use. Until you configure your own chosen value, ISC will fail requests that don’t supply an end date when one is required.
In both of these cases, the audit record for the Access Request Started event will indicate that the end date was automatically constrained either by the fallback duration or the max duration on the item.
These fallback behaviors will not apply for requests submitted through the Request Center UI, as that flow will directly enforce all date constraint requirements at the time of submission.
Who is affected?
This is being rolled out to all Suites customers.
Action Required
Administrators for organizations that heavily rely on workflows or API-submitted access requests should set the fallback duration value in the access-request-config to your organization’s preferred value.
Then, for any item where you want to enforce mandatory end dates or max duration, you need only set up the requirements per item. Navigate to Admin > Access Model > Roles | Access Profiles | Entitlements > edit the item > Access Requests. Then select Require End Date and choose a max duration if needed.
Important Dates
Calendar
By RSVP’ing to this event you will be reminded of this release prior.
Sandbox rollout: week of Jan 12, 2026
Production rollout: week of Jan 26, 2026 * < Update: due to procedural issues that resulted in an end-of-week sandbox rollout, we are delaying prod rollout 1 week to give customers time to explore the new functionality in pre-prod environments. This is the new rollout timeframe.
