Skip to content
Documentation version: IdentityIQ 9.0

Requesting Access

Based on how your system is configured, you can request access to roles and entitlements for yourself, for others, or both.

Request Access for Others

This option must be configured on the Lifecycle Manager configuration page. Access it via the Quicklink Manage User Access menu item or card on the home page.

  1. On the Select Users tab:

    1. Search for identities.

      • In the search box, enter the name or first few letters of an identity and select the Search icon Search.
      • To limit the number of listings, select Filters Filters and specify the filter criteria.

    2. Select the Select icon on the card for one or more identities. You can also select the All button to select all identities (maximum of 100).

    The selected identities are displayed above and below the search results. You can click this list of identities at any point in the access request process and remove identities from the selection.

  2. Optional: Select the User Details icon View Identity on any user card to see details about that identity. Based on how your system is configured, you can view details such as user name, first name, last name, email, location owner, region, etc.

  3. Select Next.

  4. On the Manage Access tab:

    1. If you have selected a single identity, ensure that you are on the Add Access tab.

    2. Select Browse all access items or the Search icon Search to display the full list of access items available.

    3. To search for specific access items, use one of the following methods from the dropdown list available next to the search box:

      • Search by Keywords – enter a search string and select the Search icon Search. The specifics of which attributes can be searchable is configured by your system administrator.
      • Find Users' Access – select a user from the dropdown list to see access granted to that identity so that you can choose items from that set of access and request those items for the identities in your selection. If you search on multiple users, the search results show the number and percentage of users that have each type of access. Note that this is a configurable option that may not be enabled in your particular installation.
      • Filter Population – filter by a number of configurable options such as Manager, Region, Department, Location, or Job Title to find users and see the access granted to them. Results are shown in groups that include a notification about what percentage of the given population the role or entitlement applies to. Select a percentage notification for details. Note that this is a configurable option that may not be enabled in your particular installation.

    4. Alternatively, select Filters Filters to limit the number of listings using various filtering options, including Role Source Application, Role Source Attribute, Role Classification, Entitlement Application, Entitlement Attribute, and more. After specifying your filter criteria, select Apply to see the search results.

      The Filters Filters option turns green when filtering is applied to alert you that you are seeing a filtered subset of access. To clear filtering, select Filters Filters again and then select Clear.

  5. Select the Select icon on each access item you want to add.

    When you select a role that permits additional roles, you are alerted that additional, optional roles are available and can select any of them to add to the request. After IdentityIQ validates that the user does not currently have the requested access, the number of items you selected appears on the Add Access tab.

  6. Select Next to move on to the Finalize and Submit or Set Dates, Finalize and Submit tab.

    A pop-up message notifies you if conflicting changes have been requested.

  7. Review the access request information and verify your choices. Based on how your system is configured, before you submit the access request, you can:

    • Remove an access item by selecting the Remove Item icon Remove Item on the access item.

    • Add attachments by selecting the Attachments icon Attach Files. You can attach files for single user requests only. See Adding Attachments to Access Requests.

    • Specify start and end dates with time to request access to roles and entitlements for limited duration. See Specifying Access Start and End Dates with Time.

    • Add comments to access items by selecting the Comment icon Add Comments. See Viewing and Posting Comments.

    • Set the request priority. The default is Normal Priority.

      Note

      To be able to set a priority, the Enable requesters to set request priorities checkbox must be selected at Settings > Lifecycle Manager > Configure > General Options. See Configure Tab.

    • View details about the role or entitlement by selecting the Details button.

  8. Select Submit.

    Forms are issued if further information is needed before your request can be completed.

    • If you are requesting access for a single identity, a pop-up appears enabling you to complete the form immediately or send it to your Home page.
    • If you are requesting access for multiple identities, the forms are sent directly to your Home page and no pop-up is displayed.

    A banner message confirms that your request was successfully submitted and displays the request ID.

Request Access for Yourself

If your system is set up to allow you to request access for yourself, a card with your identity details is the first card displayed on the Select User tab. This option must be configured in IdentityIQ.

  1. On the Manage My Access tab, select Add Access.

  2. Select Browse all access items or the Search icon Search to display the full list of access items available. To search for specific access items, use one of the following methods from the dropdown list available next to the search box:

    • Search by Keywords – enter a search string and select the Search icon Search.

    • Recommended For You – if AI-Driven Identity Security has been configured for your organization, this option shows access items that AI-Driven Identity Security recommends for you based on peer group analysis. Access recommendations are available only for your own access. If you are able to request access for other users such as your direct reports, you will not be offered access recommendations for those users. See Enabling Recommendations for Access Requests.

      Tip

      You can also select Yes, show my access recommendations to see AI-recommended access.

  3. Alternatively, select Filters Filters to limit the number of listings using various filtering options, including Role Source Application, Role Source Attribute, Role Source Value, Entitlement Application, Entitlement Attribute, Entitlement Owner, and more. After specifying your filter criteria, select Apply to see the search results.

    The Filters Filters option turns green when filtering is applied to alert you that you are seeing a filtered subset of access. To clear filtering, select Filters again and then select Clear.

  4. Select the Select icon for each access item you want to add.

    When you select a role that permits additional roles, you are alerted that additional, optional roles are available and can select any of them to add to the request. After IdentityIQ validates that the user does not currently have the requested access, the number of items you selected appears on the Add Access tab.

  5. Select Next to move on to the Finalize and Submit or Set Dates, Finalize and Submit tab.

    A pop-up message notifies you if conflicting changes have been requested.

  6. Review access request information and verify your choices. Based on how your system is configured, before submitting the access request, you can:

    • Remove an access item by selecting the Remove Item icon Remove Item on the access item.

    • Add attachments by selecting the Attach Files icon. See Adding Attachments to Access Requests.

    • Specify start and end dates with time to request access to roles and entitlements for limited duration. See Specifying Access Start and End Dates with Time.

    • Add comments to access items by selecting the Comment icon Add Comments. See Viewing and Posting Comments.

    • Set the request priority. The default is Normal Priority.

      Note

      To be able to set a priority, the Enable requesters to set request priorities checkbox must be selected at Settings > Lifecycle Manager > Configure > General Options. See Configure Tab.

    • View details about the role or entitlement by selecting the Details button.

  7. Select Submit.

    Forms are issued if further information is needed before your request can be completed. A pop-up appears enabling you to complete the form immediately or send it to your Home page.

    A banner message confirms that your request was successfully submitted and displays the request ID.

Request Access Containing a Permitted Role

A permitted role is generally a requested or assigned role and is not automatically granted to a user. Permitted roles are enabled by default. When permitted roles are available, they are displayed on the following tabs:

  • Add Access – when you select a role that has permits, the associated permitted roles are displayed as cards after you complete the account selection setup.

  • Review – permitted roles are displayed below the associated assigned role.

You can set start and end dates with time and comments on permitted roles.