Workflows and Default Approval routing
At a high level, when users request access to resources, they initiate workflows that attempt to execute one or more EmpowerID Operations against those resources in a manner that is consistent with the workflow. For example, if a user requests membership in a Management Role, the workflow related to that request attempts to execute operations against both the user and against the Management Role to update the person’s role membership. However, if the user does not have the access needed for those operations to execute, the workflow creates approval tasks, routing them to each person within the organization with the ability to approve the request (i.e., execute the operations in the workflow) and then goes into an idle state. These approval tasks would then appear as a task in My Tasks. Once approved, the workflow would resume and EmpowerID would fulfil the request.
Figure 1: Workflows and Default Approval Flow
This mechanism is known as “Rights-Based Approval Routing” or RBAR. With RBAR, EmpowerID maintains real-time checks of every workflow process to determine whether the current person in the process can execute the workflow’s operations. RBAR is a key component for maintaining the security of IT resources.
Enhancements to Workflow Approval Routing
While the above default approval routing is effective, EmpowerID has enhanced the process to allow organizations more control over the process. All workflows have a new property called “Never Send for Approval” and most workflows have that property set to true out of the box. When set to true, workflows simply exit when executed by someone without access to the operations in the workflow. There are a number of benefits to this, including the following:
This keeps the number of approval tasks and removes actions from the approval process that should not be there in the first place.
The workflows and the operation base no longer generate Business Process Tasks (Business Process is a workflow and all the operations in it are Business Process Tasks) when a person does not have the RBAC delegations to execute the workflow.
In addition to the above mentioned property, workflows can also be configured for Business Request Type. Business Request Type allows workflows to be classified for the purpose of providing greater flexibility in approval routing and grouping together of related access requests. Rather than having a default approval routing that simply routes unrelated approvals to all users with the delegations to approve requests, organizations can now use these properties along with new Access Request and Approval Flow policies to group together related access requests into a single “approval bundle” and further specify to whom approval tasks should go and how many approvals need to occur before fulfillment occurs. A discussion of these policies follows.
Approval Flow Policies
The purpose of Approval Flow policies is to allow organizations to direct the approval process when users request access to resources. Approval Flow policies have a number of key components that can be configured to specify how this occurs.
These components are as follows:
Business Request Type – As mentioned above, Business Request Type is a workflow property used to group workflows by the type of business request they represent. An example of a Business Request Type is the IT Shop Business Request Type. This type represents anything that is published to the IT Shop, such as Application and Business Roles, Management Roles and Azure Licenses. Approval Flow policies can be configured to specify that requests of a certain Business Request Type must go through three levels of approval, for example, before fulfillment occurs.
Approval Flow Steps – Approval Flow Steps are added to Approval Flow policies to specify how many approvals are required for fulfillment. Approval Flow policies can have as many Approval Flow Steps as needed. Each step is a sequential step that must be approved at that level to proceed to the next step. Each step can have its own approval flow as well.
Item Level Approval – Each step can be configured to allow for Item Level approval. Item Level represents the individual items in a business request, such as requesting an Office 365 mailbox or an Application Role. With Item Level approval enabled for a step, the step approver can elect to make item-by-item approvals rather than being forced to approve or reject the entire request in toto. These items
Approver Resolver Rules – Approver Resolver rules specify to whom the Approval Flow Step needs to route for approval. These can be routed to various actors in EmpowerID to include the:
Initiator Manger – The request routes to the manager of the person initiating the request
Target Person Manager – If making a request for another person, the request routes to that person’s manager for approval
Resourse Owner – Owner of the resource
RBAC Approver – Anyone with the RBAC delegations needed to approve the request
Static Approver – Approvers are specific users selected for the step
Fallback Approver – Can select someone to approve in the instance that a specified approver does not exist, such as would be the case if a Management Role was selected as a Static Approver and no one had that role
Items Types – Item Types are the individual resources that can be requested, such as membership in an Application Role.
Item Type Actions – Item Type Actions are in essence EmpowerID Operations and represent actions that can occur against an item (resource). Examples of Item Type Actions include Add Account To Group or Assign Azure License.
Access Request Policies
Access Request policies are used to control access to resources in EmpowerID and can be used to designate different Approval Flow policies for resources based on their Access Request policy. With this model, you create the Approval Flow policies first and then add them to the Access Request policy when you create it. EmpowerID includes a default Access Request policy out of the box that meets most situations.
Notification Policies
As mentioned earlier, part of the approval process involves notifications. Approvers and initiators of requests , as well as all delegated users received notifications of these events. As part of the redesign of the approval process, EmpowerID has reconfigured how notification occurs, giving users the ability to tailor the amount and type of notifications they receive to their personal preferences. How notifications now work in EmpowerID is as follows:
Each time a user submits a Business Request a Business Request Event is raised.
Business Request Events are submitted to the Business Request Notification Policy engine.
The Business Request Notification Policy engine determines if the event needs to be added to the Business Request Notification Inbox. To determine this, the engine first performs a granular scan of each person’s notification preferences, then falls back to the default system notifications if there are no personal notification preferences set.
Notifications are then sent to Business Request participants based on those notification settings.
Notification Policy Components
There are several components to Notification policies and how the Notification Policy engine delivers notifications. These include the following:
Business Request Events – There are four levels of Business Request Events where notifications can be raised.
Created — Occurs when a Business Request is created. This can be used to, for example, create a policy that sends an email notification to managers of users creating a Business Request.
Open — This is used in Approval Flow Policies with more than one Approval Flow Step to notify progressive approvers that the item is ready for them to review once a previous step has been approved by the person delegated for that step. If the previous step is rejected, then this notification would not be sent out.
Approver Set — Raised when someone manually assigns an approver to a step.
Fulfilment Ready and Fulfillment Completed — These are only available at the item level. They are relative to a specific item. These items have been approved and now they are ready to be fulfilled. This creates a notification at that level. Once fulfilled, notification events are raised. You added someone to a group in response to a request, for example.
Completed — Completed can be used at the step level and the Business Request Level to send notifications that a particular step is completed and when the Business Request itself is completed.
Business Request Participant Type — Individuals related to a specific part of a business request. are fields in the BusinessRequestParticipantType table.
Initiator — Person requesting the resource
TargetPerson — Person receiving the resource assignments
InitiatorManager — Manager of the request initiator
TargetPersonManager — Manager of the person receiving the resource
Approver — Person who approves or rejects a step
Approver Manager — Manager of the person who approves or rejects a step
Potential Approver — Selected people who could approve or reject a step (delegated)
Commenter — Person who adds comments to a request
Levels
Business Request— Shopping cart submission
Business Request Item — Individual items submitted
Business Request Approval Step — TheBusiness request is approved or rejected globally. The decision here if final.
Business Request Item Approval Step— Each item in the business request can be approved or rejected on a case-by-case basis.
Messages — Email message delivered by the notification engine to Business Request participants.
Approval Flow
While there are several pieces involved with how approvals flow in EmpowerID, the logic is straightforward. Approval flow begins at the Business Request level and then flows the items in the Business Request. If the Approval Flow Policies are configured to grant approval at the Business Request level, Item level approval is not necessary as all items in the request are approved.
Business Request Level
The Approval engine first looks at Access Requests policies to see if there is a policy for a specific Business Request Type defined with a particular Approval Flow policy.
If there is not an Access Request policy defined in this way, then the engine looks for the Approval Flow Policy of the Business Request Type.
If there is not an Approval Flow Policy specified for the Business Request Type, the engine then looks for the Approval Flow Policy of the resource from its Access Request Policy.
Item Level
The Approval engine first looks at the Item Type Action per the Access Request policy to see if the policy designates different Approval Flow policies for the resource of the item based on its Access Request policy.
If the there is not an Access Request policy defined in this way for the Item Type Action, it the looks at the Item Type Action itself to see if there is a specific Approval Flow Rule set for it. For example, an action like Add Account To Group can have a different Approval Flow Rule than the Remove Account From Group action.
Finally, if there is not a specific Approval Flow Rule set on the Item Type Action, the Approval engine falls back to the Approval Flow Policy for the item as specified on the item’s Access Request policy.
If the Approval Flow Policy does not belong to a specific Access Request policy, the Default Access Request Policy is used.
Figure 2: Approval Flow at the Business Request and Item Levels
Figure 2 above depicts from a high level how approval flows work in EmpowerID. In the figure, a new Business Request is created to onboard an employee. As part of the onboarding request, several items are requested, a Business Role, an Application Role, and a Management Role. The Approval Policy for the Business Request is configured with two Approval Steps. The first step requires approval by the manager of the employee and the second step requires approval by the finance department. In each of the steps, Item Level approval is configured, meaning that the manager and the finance department can approve individual items and reject others. Items approved by all steps are then fulfilled by the system, while items rejected within any of the steps are not.
Fulfilment
Fulfilment is the process by which EmpowerID fulfils approved Business Requests. Fulfilment is the completing action of “adding a user to an Application Role” or “provisioning a mailbox in Azure”, etc. When the items in a Business Request pass through all levels of approval, the items are then ready for fulfilment. Fulfilment is handled by the Business Request Fulfilment Job. The job does the following:
Claims items ready for fulfilment.
Send the items to the fulfilment workflow specified for the Item Action Type. For example, if a user is to be added to a Management Role, the item would be fulfilled by the workflow specified for that action.
EmpowerID executes the operations of the associated fulfilment workflows to perform those actions against the appropriate target systems.
| Div | ||||||||
|---|---|---|---|---|---|---|---|---|
| ||||||||
IN THIS ARTICLE
|