[MUSIC]
Hana Kim: My name is Hana Kim and I’m a Program Manager
in the Azure AD Engineering Identity Governance team.
Mamta Kumar: My name is Mamta Kumar and I’m also a
Program Manager on the same team.
Today, we’ll be talking about how we can enhance the
productivity of our end users by ensuring that their access
requests are completed in a timely manner. We will show you
how you can configure access requests with primary approvers
and alternate approvers using Entitlement Management, an
Azure AD Premium feature.
In this scenario, I am an access package manager at
Woodgrove Bank. We’ve been working closely with another
organization, Graphic Design Institute. In this close
collaboration, we want to make sure that users from Graphic
Design Institute are able to get access quickly, so they can
get started on their projects. When users submit requests,
the approvers may not get to it as soon as possible. This
results in the requester waiting for access for several days.
If the approvers are perhaps super busy, say at an all week
conference, they may miss the pending request. When that
happens, the request eventually expires and the requester
gets nothing after waiting for several days. To mitigate
this situation, we have the capability of bringing in alternate
approvers, who are able to help out with pending approvals.
Intent is to prevent requests from expiring.
Lets do a walkthrough of setting up primary approvers and
alternate approvers.
We are setting up a policy for the interns from Graphic Design
Institute to work on this project with us. These are the
primary approvers, Jessica Li. I’m going to add Hana as
the other primary approver.
The request will expire in 10 days.
In the advanced request settings, we see that there is a
toggle for forward to alternate approvals, and we will configure
that. For alternate approvers, I will add Victor
and myself as the alternate approvers.
To ensure that requests are getting approved or denied, we
need to configure the time after which if the request is still
pending, it will get forwarded to alternate approvers. In our
case, we can forward the request to alternate approvers from
day 6 through day 9. In the best case scenario, we want the
primary approvers to approve or deny the request. When a
request is submitted, they receive an email notification to
approve or deny the request. If the request is still pending,
based on the duration of the request—in our example, the
duration being 10 days—the primary approvers also receive
a reminder email at half-life of the request, which is on day
5. Requests can be forwarded to alternate approvers starting
one day after the half-life of the request. Also, requests
cannot be forwarded on the last day. We will schedule
forwarding to happen on day 7.
Forwarding only happens if the request is still pending on
that day. Now that the policy’s configured, all new requests
will include the forwarding capability.
Hana: Let’s look at what the primary approvers see.
As the primary approver, I see that Joe just submitted a
request for access to Design Project 2020. I see that on
November 8th if the request is still pending, it will be
forwarded to alternate approvers.
I’ll go ahead and approve this request.
I also see that Joe has submitted a request for Design
Project 2019 a few days ago.
I see that is has been forwarded to alternate approvers.
I also see that the request will expire on November 5th.
As a primary approver, I can still approve or deny the request.
Mamta: Let’s take a look at what the alternate approvers
see when the request is forwarded to them.
As the alternate approver, I see that Joe had submitted a
request for Design Project 2019 several days ago, and his
request was forwarded to me, as the primary approvers haven’t
approved or denied it yet. I also see that the request is going
to expire in a few days. I will go ahead and approve the
request.
Hana: Both the primary approvers and the alternate approvers
are notified when the request is completed.
Thanks for joining us to learn about how requests can be
forwarded to alternate approvers as part of the request
approval policy in Azure AD Entitlement Management. To
learn more, check out our other videos.
[MUSIC]