Skip to content

Access Request Administration Overview

Identity Security Cloud requires users to execute core governance processes throughout the product, such as access requests, certifications, and provisioning tasks. Instead of an access request being viewable only by the user who submitted it, admins can also view and manage everything that users see in the Request Center > My Requests UI.

This functionality is helpful when a pending access request is stuck and an administrator needs to be able to view, examine, and reassign it. Using Access Request Administration, admins can view and manage all work across Identity Security Cloud to enable the timely flow of governance activities.

Refer to User Level Permissions for information about user levels specific to Access Request Administration.

Using Access Request Administration

Log into Identity Security Cloud as an administrator and go to Admin > Dashboard > Access Request Administration.

The Access Request Administration page defaults to a table view, but you may use the toggle at the right to view the same information on cards. By default, the requests are sorted by age, with the newest at the top.

Each access request includes the following information:

  • Access Name
  • Access Request ID
  • Assigned to – Identity that this task is assigned to. When the next review is assigned to more than one person or a governance group, this column displays “Multiple.”
  • Access for – Identity that the access is for
  • Requested by – Name of the requestor
  • Days old – Elapsed time (in days) since the request was submitted
  • Status – Status of the request, including Executing, Partial Prov. Failed, Error, Canceled, Rejected, and Completed
  • Actions – Includes View Details, Reassign, Remind User, and Cancel Request

From the Actions column, you can View Details, Reassign, Remind User, or Cancel a Request for a request. Alternately, you can select an item in the Access Name column to see the Details panel. From there, an admin can:

Searching for an Access Request

Search for an access request by request ID by pasting or entering Access Request IDs in the search bar at the top of the Access Request Administration page. Add comma-separated values to find multiple access requests. Queries are limited to 350 characters.

Note

This is the only Identity Security Cloud search bar where you can search with comma-separated values.

Filtering Access Requests

To find an access request on the Access Request Administration page using characteristics other than ID, use the Filter icon next to the search field to filter by Requested For, Requested By, Created Date, Current Owner, and/or Status. Add as many filters together as you want.

Select Apply to apply the selected filters. To remove filters, select X next to any filter criteria, then select Apply.

Available filters include:

  • Requested For – Identity that the access is requested for
  • Requested By – Identity that submitted the request
  • Created Date – Date that the request was created
  • Current Owner – Identity to whom the request is currently assigned
  • Status
    • Pending – Request is executing
    • Completed – Request has been completed
    • Canceled – Request was terminated by the user before it was able to complete
    • Denied – Request was rejected by the approver
    • Provisioning Failed – The request has failed to complete, and not all items were provisioned
    • Error – Other error

Important

When you filter based on Status, some Error statuses may occur where you do not expect them. This happens because Error is a calculated status, rather than a static status.

Quick filters are available above the table to the left. They are All, Pending, and Concluded. The quick filters add on to any other filters you may apply. For example, if you select the quick filter Concluded, then select the Filter icon , the Filters overlay shows that the Concluded statuses have been added to the filter’s states.

Note

The Concluded filter lists all requests that are no longer pending. This includes requests with a status of Completed, Canceled, or Denied, as well as requests with Not All Items Provisioned or Provisioning Failed

Managing Access Requests

On the Access Request Administration page, select an Access Name to review the request information. The Grant: [Access Name] panel appears.

On the Workflow tab, view the flow of the access request and provisioning. This includes the status of each task or the date it was completed.

On the Details tab, view access request details, such as description, type, created date, and status.

On the Assignees tab, view who is assigned to approve the access request. When a review is assigned to a governance group, it is actually assigned to the individual members of that group. In that case, the assignee listed on the Workflow tab is “Multiple” to let you know it’s assigned to more than one person. The Assignees tab lists the individuals who are currently assigned as part of the governance group. You have the option to remind or reassign any of the current assignees from the Assignees tab.

Reassigning an Access Request

Admins can reassign an access request to someone else.

  1. Locate the request you need to reassign.

  2. Select Reassign from one of three places:

    • In the Actions column, select Reassign.

    Note

    When the request is assigned to multiple approvers, the Reassign option in the Actions column is disabled.

    • Select the Access Name, then select Reassign at the bottom of the panel.
    • Select the Access Name, go to the Assignees tab, then select Reassign next to the person whose review you want to reassign.

  3. Enter a name in Reassign To.

    Note

    You can’t reassign an access request review to a group. To reassign an item that is currently assigned to a governance group, you need to reassign it to an individual.

  4. Enter comments.

  5. Select Reassign.

After a request is reassigned, the new approver is listed in the Assigned To column on the Access Request Administration page. You can also view a record of the changed assignment in the request’s Grant: [Access Name] page on the Workflow tab.

Reminding an Approver of an Access Request

Send email to remind someone of an access request they are assigned to review.

  1. Locate the request on the Access Request Administration page.

  2. Select Remind from one of two places:

    • In the Actions column, select Remind User.

    Note

    When the request is assigned to multiple approvers, the Remind option in the Actions column is disabled.

    • Select the Access Name, then select Remind User at the bottom of the panel.

  3. An email link opens with a message addressed to the assigned reviewer. You can add a subject, edit the message, and send.

Overwriting an Access Request Approver

Overwrite an access request approval without the currently assigned approver. This only overwrites the current approval step, not all steps in the workflow.

  1. Locate the request on the Access Request Administration page.
  2. Select the Access Name.
  3. In the Grant or Remove panel, select More.
  4. Select Overwrite Current Approver.
  5. Enter comments.
  6. Select Approve Request.

View a record of the approval on the access request’s Details page.

Canceling an Access Request

You can cancel an access request that’s no longer valid.

  1. Locate the request on the Access Request Administration page.
  2. Select Cancel Request from one of two places:
    • In the Actions column, select Cancel Request.
    • Select the Access Name, then select More > Cancel Request.
  3. Enter comments.
  4. Select Cancel Request.

The Status column updates to Canceled. An email is sent to the requester to confirm that the request has been canceled.

Bulk Actions

You can approve, cancel, or reassign multiple access requests at once.

  1. On the Access Request Administration page, select the checkboxes next to the Access Names that you want to include.

    Note

    For efficiency, you can filter for the requests you need, then select everything in the list using the checkbox above the table.

  2. Select Cancel, Approve, or Reassign at the top right side of the table. The action will apply to all of the selected access requests.

Documentation Feedback

Feedback is provided as an informational resource only and does not form part of SailPoint’s official product documentation. SailPoint does not warrant or make any guarantees about the feedback (including without limitation as to its accuracy, relevance, or reliability). All feedback is subject to the terms set forth at https://developer.sailpoint.com/discuss/tos.