Forwarding pending access requests

Identity Security Cloud (ISC) ISC Discussion and Questions
1

Hello everyone,

Is there a way for an admin to forward an access request that is stuck in approval phase, other than with an API call?
There are several circumstances leading to such a situation, for instance: approver is on holiday / has left the company / does not respond.
I am looking for a way to this in the graphical user interface, as this seems to be a very common situation.

2

You can try using Work Reassignment for this.

Open the Identity and configure Work Reassignment, All the approvals will be reassigned.

3

Hey @mkoornneef3
You can try using Work Reassignment

Configuring Work Reassignment - SailPoint Identity Services

4

You can use a fallBackApprover

image
image887×302 38.2 KB

5

Does this also work for access requests that are already pending for approval before the reassignment is configured?

6

Hello @mkoornneef3

You are talking about 3 different situations:

  1. Approver is on holiday: the identitiy should configure the work reassignment with a due date
  2. Approver has left the company: the manager of the leaving identity should receive an email through workflows saying that has some identities delegated of an inactive identity
  3. Approver doesn’t respond: The requester should talk to the approver in order to approve/deny the requirement

Regards,
Pablo

7

Hi all,
Thank you for the replies. These are all good practices to follow, to prevent situations like this from happening.
However sometimes these practices are not followed and the approval request still ends up waiting on someone who is not able to respond. Hence, the access request is ‘stuck’.
Submitting a new access request also does not help because it gets cancelled by the system, because there is already a pending request.
In that occasion, is there still something an admin can do to re-assign the request?

8

Each of these use cases needs to be addressed in different way

  1. approver is on holiday > Work reassignment
  2. has left the company > Lifecycle Management to transfer the ownership to a new user
  3. Not responding > Auto reminders are sent from SailPoint. Also, you can use Governance groups instead of individual approver. Plus, some Business Process put in place so that users don’t simply ignore their responsibilities