When a user requests the Access Profile through ServiceNow, the request is sent to the user’s manager as expected.
However, after the manager approves, the request workflow displays:
Waiting for Approval
2Manager X(Approved)
4 Manager X (Requested)
It appears as though the same manager is being requested to approve a second time.
Questions:
Is this expected behavior when using the ISC Workflow approval type with ServiceNow Catalog? How to correct it?
Does ServiceNow create multiple approval records during approval synchronization with ISC?
Has anyone observed the same approver showing both Approved and Requested in the workflow even though only a single Manager reviewer is configured in the Access Profile?
Is there a way to determine whether the second approval is coming from ISC or from the ServiceNow approval workflow?
Any guidance or recommendations would be appreciated.
HI @amithkumar1
This is the known issue because of conflict of time between the servicenow workflow poling and the how the SailPoint approval state works.
Here are answer of your questions:
No, its a loop defect.
Yes, service now maps the plan from the SailPoint.
it could be either one of them in the ISC search - we can check this with the “LCS success events” or “Access Request”.
To resolve this we can use the Auto Approval enabled in the service now and then increase the polling wait time, the threshold delay from the default 2min to 5 min at least.
Hello Amithkumar. With a single Manager reviewer on an Identity Security Cloud Workflow definition, I would not expect two separate approval steps. I would first confirm whether ISC actually created two approval items or ServiceNow is showing another approval record.
sysapproval_approver for the RITM, which SailPoint documents as holding the current and historical approval records, to see whether ServiceNow has both an Approved and a new Requested record.
List Access Request Approvers in ISC, and compare the returned approvalId values. If the same manager has multiple approval IDs, ISC has created multiple approval items for that request.
If ISC shows only one approval ID but ServiceNow has both Approved and a new Requested record, I would focus on the ServiceNow synchronization side.
Also, Auto Approve does not apply to ISC Workflow. For the pending-approval population issue, SailPoint documents a 32-minute timer before Get IdentityNow Pending Approvals, not a 2-to-5-minute polling change.
The thread Deepak linked involved two approval definitions resolving to the same user with no deduplication between approval levels. I would compare against that scenario only if ISC shows multiple approval IDs for this request.
Try and see if the wait time between when ServiceNow marks the approval in SailPoint as completed and when it checks to see if there are additional approvals are waiting needs to be extended - This KB article suggests 35 minutes but honestly 3-5 minutes is probably a sufficient delay between those steps
Basically, ServiceNow marks the approval record in ISC as completed, waits a moment, then queries ISC again to see if there are any remaining approvals tied to that access request. It’s possible that time is so short that the API response from ISC is still showing that initial manager approval and ServiceNow thinks it’s a new pending approval, so it creates it again
