Configuring Access Requests for Entitlements

After you've created sources and uploaded entitlements, you can configure access requests for entitlements.

Important

Be sure the name and description of requestable entitlements are user-friendly and easy to understand. Detailed descriptions will improve the accuracy, quality, and speed of requests and review decisions.

Enabling Entitlement Requests Globally

Enable entitlement requests and configure how you want them to function globally in your tenant. After enabling entitlement requests globally, you can choose to override the approval and comments configuration for individual entitlements.

If entitlement requests are not enabled, entitlement removal requests are automatically disabled globally, too. If you want to allow revocation but not entitlement requests, enable entitlement requests globally but do not enable any entitlements to be requestable. Optionally, you can also set up a global and/or entitlement-level approval configuration for revocation.

Go to Admin > Global > System Settings.
Select Feature Settings from the left pane.
Under Feature Settings, select Access Request, and select Enable Entitlement Requests to enable it.

Selecting this checkbox enables the feature for your site, but you'll still be able to choose which entitlements are and aren't requestable.
By default, Enable Machine Identity Access Requests is enabled, allowing human users to request entitlements for machine identities. If you want to disable access requests for machine identities, toggle to the Off position.
Go to the Entitlement Requests subsection.
If you want entitlement requests to require review, select the Require Approval checkbox.
If you are requiring approval, select the dropdown menu under Select Reviewers.

You can choose from the following identity type options:
- All Owners - The primary owner or any additional owners configured for the entitlement. Any one primary owner or additional owner can approve.
- Primary Owner - The identity configured to own the entitlement will review entitlement requests.
- Additional Owners - Additional identities and/or a governance group designated as secondary owners of the entitlement. If the primary owner is configured as the first reviewer, the additional owners will not see the approval request until the primary owner has already approved. Only one of the additional owners is required to approve.
- Governance Group - Members of a governance group will review entitlement requests. When you choose this option, another dropdown list appears to select which governance group. Only one identity in the governance group is required to approve.
- Source Owner - The owner of the source the entitlement comes from will review entitlement requests.
- Manager - The manager of the requester will review entitlement requests.
If you need multiple approvers, select Add Reviewer and repeat the previous step to add other reviewers.
- Select the icon to rearrange the reviewers into the order they should be asked for approval. To remove a reviewer from the list, select the X icon in that reviewer’s row.
If you want to require comments at any point in the submission or review process, select one or more of the options under Require Comments:
- Require comments when User requests - The user requesting access will be required to submit a comment alongside their request.
- Require comments when Approver denies - When a reviewer denies a request for access, they'll be required to leave a comment explaining their decision.
- Require comments when a reviewer approves a request with violations - When a reviewer approves a request that has policy violations, they are required to leave a comment.
Go to the Entitlement Removal Requests subsection.
If you want entitlement revocation requests to require review, select Approval Required.
If you are requiring approval, select the dropdown menu under Select Reviewers. You can choose from the following options:
- All Owners - The primary owner and any additional owners configured for the entitlement will review entitlement removal requests. Any one primary owner or additional owner can approve.
- Primary Owner - The identity configured to own the entitlement will review entitlement removal requests.
- Additional Owners - Additional identities and/or a governance group designated as secondary owners of the entitlement will be required to review entitlement removal requests. If the primary owner is configured as the first reviewer, the additional owners will not see the approval request until the primary owner has already approved. Only one of the additional owners is required to approve.
- Governance Group - Members of a governance group will review entitlement removal requests. When you choose this option, another dropdown list appears to select which governance group. Only one identity in the governance group is required to approve.
- Source Owner - The owner of the source the entitlement comes from will review entitlement removal requests.
- Manager - The manager of the requester will review entitlement removal requests.
Select Save.

After this, you must now configure individual entitlements to be requestable.

Marking Entitlements as Requestable

Make source entitlements available for users to request in the Request Center.

Go to Admin > Connections > Sources.
Select or edit the source you want to update.
In the Entitlement Management section, select Entitlements.
Select the checkbox beside the entitlements you want to mark as requestable.
Select the Actions dropdown list and choose Mark as Requestable.

Alternatively, you can make source entitlements available for users to request from the Entitlements page.

Go to Admin > Access Model > Entitlements.
Locate the entitlement that you want to update.
Select Actions > Mark as Requestable.

Configuring Individual Entitlement Access Requests

You can configure access requests and access revocation requests for individual entitlements. The approval process defined for individual entitlements supersedes the approval process defined for the source and globally in your tenant.

Note

Before you can make entitlements requestable, you must enable access requests for entitlements in your org.

To configure an entitlement for access requests:

Go to Admin > Access > Entitlements.
Select Actions > Edit for the entitlement you want to update.
Select Access Requests from the left panel.
Select the Allow Access Requests toggle if the entitlement is not already marked as requestable.
Select the Require Access Request Form toggle if you want requesters to complete a form when they request access to this entitlement.
- From the dropdown menu, select which form to require.
Note

When you attach a form, it automatically includes the start date, end date, and comments fields.
Select the Require End Date toggle if you want to require requesters to include an end date and time in each request.
- (Optional) If you require an end date and time for requests, you can also set a maximum duration in hours, days, weeks, or months.
Note

The maximum duration is enforced from the time of the request and must account for the time that it will take for approvals to be completed. When an access start date is specified, any configured max duration requirement is applied for the access end date based on the selected start date and time instead of the moment of request.

This may affect requests with short durations in particular.
(Optional) To require approvals for requests, select the Require Approval option under Reviewing Access Requests.

Note

If you don't choose Require Approval, the global approval configuration still applies.
- Select either Reviewer, if you want to add an individual or governance group to review, or Workflow, if you want an approval workflow to process the approval.
- If you selected Reviewer, choose an identity or governance group from the dropdown list and select the icon to add them as a reviewer.
  - All Owners - The primary owner and any additional owners configured for the entitlement will review entitlement requests. Any one primary owner or additional owner can approve.
  - Primary Owner - The identity configured to own the entitlement will review entitlement requests.
  - Additional Owners - Additional identities and/or a governance group designated as secondary owners of the entitlement will be required to review entitlement requests. If the primary owner is configured as the first reviewer, the additional owners will not see the approval request until the primary owner has already approved. Only one of the additional owners is required to approve.
  - Governance Group - Members of a governance group will review entitlement requests. When you choose this option, another dropdown list appears to select which governance group. Only one identity in the governance group is required to approve.
  - Source Owner - The owner of the source the entitlement comes from will review entitlement requests.
  - Manager - The manager of the requester will review entitlement requests.
- If you selected Reviewer and need multiple approvers, repeat the previous step to add additional reviewers.
  - Use the arrows to rearrange the reviewers into the order they should be asked for approval. To remove a reviewer from the list, select the icon in that reviewer's row.
- If you selected Workflow, use the dropdown to select from a list of workflows that are compatible with this type of approval. Only enabled workflows using the Access Request Submitted trigger are listed.
  
  Note
  
  When selecting the Workflow option, make sure that you understand the functionality of that workflow or consult with your Org Admin to define a Workflow that functions as you intend.
(Optional) Under Require Comments, specify when comments must be provided.
- Select When the user requests access to require the user to provide a comment or business justification when they submit a request.
- Select When a reviewer denies the request to require the request reviewers to provide a comment or reason when they reject a request.
- Select Require comments when a reviewer approves a request with violations to require reviewers to provide a comment when they approve a request that has policy violations.
Note

If comments are required by your global configuration, they will still be required even if this is left blank.
(Optional) To require approvals for revocation requests, select the Require Approval for Removal checkbox. Choose an approver, such as a manager, owner, or governance group from the dropdown list and select the icon to add them.
- If you require approvals for revocation requests and need multiple approvers, repeat this step to add additional reviewers.
  - Use the arrows rearrange the reviewers into the order they should be asked for approval. To remove a reviewer from the list, select the icon in that reviewer's row.
Note

If you don't choose Require Approval for Removal, the global revocation configuration still applies.
In the Timeout field, select the number of days you want to allow before requests expire. 90 days is the maximum.
In the Reminders section, select the toggle if you want to enable reminders, then complete the following fields:
- Number of Reminders - Maximum number of reminders that will be sent.
- Days After the Request to Start Reminders - Number of days after an approval request is initiated before you want the first reminder to be sent.
- Reminder Frequency - How often reminders will be sent. Options include daily, weekly, or monthly.
- Times - Time of day the reminders will be sent.
- Schedule Preview - Review the schedule on which reminders will be sent. If adjustments are needed, make changes to the prior fields and recheck the schedule preview.
Note

Time zone is configured at the bottom of the page.
In the Escalations section, select the toggle if you want to enable escalations, then complete the following fields:
- Days After the Request to Start Escalation - Number of days after an approval request is initiated before you want the first escalation to take place.
- Escalation Frequency - The timing of approval escalations. Options include daily, weekly, or monthly.
- Times - Time of day the escalation will take place.
- Reviewers - Select Edit Approvers to open the Escalation Chain interaction.
  - Make changes to the Reviewer Category or select Add Approver. Available options include Manager, Identity, Governance Group, or Owners.
  - When you add an approver in the Identity or Governance Group category, a field appears where you can select which one.
  - Select Save.
  - To reorder approvers, select Edit Approvers, then select the reorder icon next to an approver to click and drag. Select Save.
- Fallback Approver - Select a Reviewer Category. When you add an approver in the Identity or Governance Group category, a field appears where you can select which one. A request is sent to a fallback approver when it has been routed through the full Approvers escalation chain and no one has taken action on it. Refer to Escalation Pattern.
- Schedule Preview - Review the schedule on which reminders will be sent. If adjustments are needed, make changes to the prior fields and recheck the schedule preview.
Set the Time Zone that will apply to all escalations and reminders.
Select Save.

Users can now request the entitlement from the Request Center. If the identity needing access has multiple accounts on a source, the requester will select which account should receive that access.

Notes

You can use the API to configure requirements for entitlement approval and comments per source as well. If set, this configuration behaves like a global configuration for all entitlements connected to that source. It can be overridden with changes or additions at the entitlement level.
For sensitive or regulated access items you can enable reauthenticated approvals to require reviewers to reauthenticate when they approve a request.

Revoking Requested Entitlements

Once an entitlement has been assigned to an identity using access requests, it will be provisioned to the human or machine identity's source account. If the entitlement is directly removed from the account on the source, it will be reprovisioned to the account at the next aggregation.

If the account is deleted on the source, such as Active Directory, it is recreated along with the requested entitlement upon the next refresh.

To remove an entitlement from a human or machine identity after it's assigned through access requests, you can:

Submit a revocation request.
Revoke it in a certification campaign.
Revoke it by submitting an API call with the Submit Access Request endpoint. You can only submit revoke requests for one entitlement at a time.
Delete the entitlement itself on the source.

Documentation Feedback

Feedback is provided as an informational resource only and does not form part of SailPoint’s official product documentation. SailPoint does not warrant or make any guarantees about the feedback (including without limitation as to its accuracy, relevance, or reliability). All feedback is subject to the terms set forth at https://developer.sailpoint.com/discuss/tos.