Escalation Policy Changes using Update Access Request Configuration v3 API

Identity Security Cloud (ISC) ISC Discussion and Questions
,
1

I am attempting to change our global escalation policy for our tenant so that approvals do not “roll up” to the manager of whomevers queue it is sitting in. I am getting an error upon attempting to use this API but it is rather generic: The request was syntactically correct but its content is semantically invalid. The goal here is to still have reminder emails be sent but not have requests escalate to the boss of the user in the approver queue after X amount of days.

I will paste my body below to see if there is something I am overlooking. I have redacted some information within the name, ID and email fields but those are just my profile name, email and sailpoint identity ID.

{
  "approvalsMustBeExternal": false,
  "autoApprovalEnabled": true,
  "requestOnBehalfOfConfig": {
    "allowRequestOnBehalfOfAnyoneByAnyone": true,
    "allowRequestOnBehalfOfEmployeeByManager": true
  },
  "approvalReminderAndEscalationConfig": {
    "daysUntilEscalation": null,
    "daysBetweenReminders": 1,
    "maxReminders": 1,
    "fallbackApproverRef": {
      "type": "IDENTITY",
      "id": "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx",
      "name": "fName Lname",
      "email": "[email protected]"
    }
  },
  "entitlementRequestConfig": {
    "allowEntitlementRequest": true,
    "requestCommentsRequired": false,
    "deniedCommentsRequired": false,
    "grantRequestApprovalSchemes": "sourceOwner"
  }
}
2

You need to set daysUntilEscalation. This is the number of days after the request is submitted to wait before sending the first reminder email. It is not the number of days before the escalation happens. This is most likely why you are getting that error.

You cannot turn off the escalation process to my knowledge.

3

Thank you for the response! I familiarized myself with both of those links posted and saw the daysUntilEscalation was capable of being nullable which i thought was how to null escalations.
So to clarify is the escalation policy locked at 14 days? Meaning a request that has been in a certain governance groups queue for 14 days will automatically be moved to their manager.

4

The escalation policy is not locked at 14 days. That is just an example SailPoint is providing. The escalation happens after the configurable max reminders have elapsed as described in the API specification.

undefined
undefined1300×622 56 KB

5

If I wanted 0 escalation to the manager and I want it to stay in that queue indefinitely OR just deny the request after 14 days how would I configure that? I was under the assumption from your previous comment “You cannot turn off the escalation process to my knowledge” that meant I can not disable or change sailpoint moving requests to the manager of the user after X days

6

From what I’ve seen you could set the max reminders to some ridiculous amount or implement a workflow/script to automatically go search for opened work items and automatically deny them after they have been opened for X amount of days.

7

This topic was automatically closed 60 days after the last reply. New replies are no longer allowed.