Get all validated access requests for a specific source

[khalilgahbiche]

Is there a way to retrieve all the validated access requests for a specific source only?

I’ve tried the following queries but non of them fulfilled our requirement:

@approvals(result:Finished)
@approvals(result:Finished) AND @expansionItems(source.name:"SAP S/4HANA")

Thanks.

[shekhardas1825 (Shekhar Das)]

Hi @khalilgahbiche,

If you are looking for approved and provisioning completed query, please use below:

"Access Request" AND status:complete AND sources:"Active Directory"

Replace source name as per your requirement!

I would also recommend you read below document, which will help you build your query as per the event (find with Access_Request):
Audit Events in Cloud Audit - Compass

Hope this will help!

[khalilgahbiche]

Thanks @shekhardas1825 for your reply,
Is there a way to retrieve only requests that have been approved and not rejected?

[shekhardas1825 (Shekhar Das)]

@khalilgahbiche you can use below:

@approvals(result:Finished) AND sources:"Active Directory" AND status:complete

[khalilgahbiche]

The result isn’t as expected. Indeed, it doesn’t show that user1 has approved access for user2. It only shows that user2 has now a specific role on the target source. Also, I the “Requestor” and “Recipient” are the same user, which is kind of weird.

[shekhardas1825 (Shekhar Das)]

For me it is showing as you required, requester is correct, and recipient is correct and under completed approvals the approver name will be shown.

I would suggest you use different users as requester / actual request for a user (Recipient) / approver.

for e.g.
You are requesting for user xyz → user abc as the approver

Note: the requester should not be the approver, or it will get automatically approved.

Also, if you are requesting for yourself then the requester and recipient would appear the same.

You can also use below search query:

"Request Access Approved" AND "Active Directory"

You will see Actor(approver) and Target(recipient).

Just replace with your source name, any access request which gone through an approval will be logged here.

[khalilgahbiche]

Thanks, this query is the closest to my need.