Approvers cannot be established
You can specify a fallback approver if requests cannot be approved because no approvers are available. A request is then always assigned to the fallback approver for approval no approver can be found in an approval step in the specified approval procedure.
To specify fallback approvers, define application roles and assign these to an approval step. Different approval groups in the approval steps may also require different fallback approvers. Specify different application role for this, to which you can assign employees who can be determined as fallback approvers in the approval process. For more information, see the One Identity Manager Authorization and Authentication Guide.
To specify fallback approvers for an approval step
Request sequence with fallback approvers
-
No approver can be found for an approval step in an approval process. The request is assigned to all members of the fallback approver application role.
-
Once a fallback approver has approved a request, it is presented to the approvers at the next approval level.
NOTE: In the approval step, you can specify how many approvers must make a decision on this approval step. This limit is NOT valid for the chief approval team. The approval step is considered to be approved as soon as ONE fallback approver has approved the request.
-
The request is canceled if no fallback approver can be found.
Fallback approvers can make approval decisions on requests for all manual approval steps. Fallback approvals are not permitted for approval steps using the CR, SB, CD, EX, and WC approval procedures or OC and OH approval procedures.
Related topics
Automatic approval on timeout
Requests can be automatically granted or denied approval once a specified time period has expired.
To configure automatic approval if the timeout expires
If a request is decided automatically, the requester can be notified by email.
Related topics
Halting a request on timeout
Requests can be automatically halted once a specified time period has been exceeded. The action halts when either a single approval step or the entire approval process has exceeded the timeout.
To configure halting after the timeout of a single approval step has been exceeded
To configure halting on timeout for the entire approval process
If a request is halted, the requester can be notified by email.
Related topics
Approval by the chief approval team
Sometimes, approval decisions cannot be made for requests because the approver is not available or does not have access to One Identity Manager tools. To complete these requests, you can define a chief approval team whose members are authorized to intervene in the approval process at any time.
The chief approval team is authorized to approve, deny, or cancel requests in special cases or to authorize other approvers.
IMPORTANT:
-
The four-eye principle can be broken like this because chief approval team members can make approval decisions for requests at any time. Specify, on a custom basis, in which special cases the chief approval team may intervene in the approval process.
-
The chief approval team members may always approval their own requests. The settings for the QER | ITShop | PersonInsertedNoDecide and QER | ITShop | PersonOrderedNoDecide configuration parameters do not apply for the chief approval team.
-
Approvals made by the chief approval team are not automatically transferred to other approval levels. Settings for the QER | ITShop | DecisionOnInsert, QER | ITShop | AutoDecision and QER | ITShop | ReuseDecision configuration parameters do not apply to the chief approval team.
-
In the approval step, you can specify how many approvers must make a decision on this approval step.
-
If an approval decision is made by the chief approval team, it overrides the approval decision of just one regular approver. This means, if three approvers must approve an approval step and the chief approval team makes a decision, two more are still required.
-
The number of approvers is not taken into account if the request is assigned to fallback approvers. The chief approval team can also approve in this case. The approval decision is considered to be made as soon as one member of the chief approval team has made an approval decision about the request.
-
If a regular approver has added an additional approver, the chief approval team can approve for both the regular and the additional approvers. If both approvals are pending, a chief approver first replaces the regular approver's approval only. Only a second approval of the chief approval team can replace the approval of the additional approver.
The chief approval team can approve requests for all manual approval steps. The following applies:
-
Chief approval team decisions are not permitted for approval steps using the CR, SB, CD, EX, and WC approval procedures or the OC and OH procedures.
-
If a member of the chief approval team is identified as a regular approver for an approval step, they can only make an approval decision for this step as a regular approver.
-
The chief approval team can also make an approval decision if a regular approver has submitted a query and the request is in hold status.
To add members to the chief approval team
-
In the Manager, select the IT Shop > Basic configuration data > Chief approval team category.
-
Select the Assign employees task.
In the Add assignments pane, assign the employees who are authorized to approve all requests.
TIP: In the Remove assignments pane, you can remove the assignment of employees.
To remove an assignment
- Save the changes.
Related topics
. Enter the application role name and assign a parent application role. For detailed information, see the One Identity Manager Authorization and Authentication Guide.
NOTE: The number of approvers is not applied to the fallback approvers. The approval step is considered approved the moment as soon as one fallback approver has approved the request.
.