We are currently implementing the ServiceNow Catalog integration with SailPoint ISC and testing approval configurations.
Our initial use case is to expose a selected set of AD group entitlements as requestable through ServiceNow Catalog. Over time, this could scale to thousands of entitlements, so we would like to understand the recommended design approach.
1. Common approval configuration for multiple access items
If a large number of entitlements require the same approval model (for example, Manager Approval), is there a recommended way to configure the approval once and reuse it across multiple entitlement/access profile objects?
For example, if 1,000 entitlements all require manager approval, can they share a common approval configuration or approval definition in ServiceNow Catalog, or must each entitlement/access profile be individually mapped to approval rules and definitions?
Our goal is to avoid maintaining hundreds or thousands of individual approval mappings in ServiceNow.
2. Approval logic maintained in ISC, approval action completed in ServiceNow
Is it possible to use ISC as the source of approval governance while presenting and completing the approval task in ServiceNow?
Example:
Approval requirements are maintained on the ISC access object (Access Profile reviewer, Governance Group, Manager, etc.)
User submits the request through ServiceNow Catalog
Approval is presented and completed in ServiceNow
Approval outcome is sent back to ISC
ISC provisions the access
Ideally, we would like ISC to remain the system of record for access governance and approval definitions, while ServiceNow provides the request and approval user experience.
Is this supported out-of-the-box, or is it necessary to build and maintain approval rules/definitions for each entitlement or access profile within ServiceNow to achieve this requirement?
Any recommendations or implementation experience would be greatly appreciated.
If you want SailPoint to essentially be a “black box” that receives approved provisioning requests, you can just utilize generic approval definitions and use some of the OOB rules like “ServiceNow Manager” or “ServiceNow Group”, then create one-off definitions/rules for the items that require a different approval scheme.
If you want SailPoint to be the source of truth for approval flow, you’d use the Identity Security Cloud Workflow rule tied to a generic definition described above. This scenario maps to item 2 in your request. The approvals are essentially generated in ISC, then copied over to ServiceNow for the end user to action them in ServiceNow. Once done, the workflow in ServiceNow updates the approval record in ISC with the result, and continues in a loop until no approvals remain on the ISC side.
For Question 1, you can leverage Approval Flexibility in the ServiceNow Service Catalog integration by creating reusable Approval Rules and associating them through Approval Definitions. This allows the same approval logic (for example, Manager Approval) to be reused across multiple access objects. However, each Access Object (Role, Access Profile, or Entitlement) still needs to be mapped to an Approval Definition as described in the Approval Flexibility documentation: Approval Flexibility.
For Question 2, the standard integration supports different approval flow options, including None, Manager Approval, and Configurable Approvals. If the approval flow is set to None, approvals are handled entirely by ISC. If Manager Approval or Configurable Approvals is selected, ServiceNow manages the approvals before sending the approved request to ISC for provisioning. A hybrid model where ISC remains the approval engine while approvals are presented and completed in ServiceNow is not supported out of the box and would require custom integration. This behavior is explained in the Configuring Approval Flow documentation: Configuring Approval Flow
