EmpowerID ships with over 100 email templates for every situation that we have identified that warrants a notification. Many of these must be enabled explicitly.

You can use email test mode to send all email notifications to one email account to ensure that you have them configured correctly before you begin sending them out to users.

To enable email test mode

  1. In the web application, expand Admin, then EmpowerID Servers and Settings, and click EmpowerID System Settings
  2. Search for "emailtest" and click the Edit button next to EmailTestMode.



  3. In the dialog that appears, change the Value from false to true and click Save.

    Do not change the Name field. Changing the Name field disconnects the setting from EmpowerID.




  4. To set the email address to which to send all notifications, click the Edit button next to EmailTestModeGlobalRecipient.
  5. In the dialog that appears, enter the email address in the Value field and click Save.

    Do not change the Name field. Changing the Name field disconnects the setting from EmpowerID.


    A copy of every email is sent to the email address provided here, even after you turn off test mode. This is a good way to keep an archive of every email.


Message recipients

  • Onboarding emails are sent to the newly created person, and to the manager specified in the CreatePerson workflow.
  • Approval emails are sent to the people who run request workflows and, if they are sent for approval, those who approve them.
  • Password emails, expiration warnings, and other personal notifications are sent to the affected user.
  • Management role notification emails are sent to people who have management roles that enable them to receive the messages.
    • EmpowerID Security Alerts — Allows admin users to receive security event related alerts.
    • EmpowerID System Notifications — Allows users to receive alerts concerning EmpowerID system events such as failed jobs.
    • Group Membership Change Alerts — Allows admin users to receive notifications of group membership changes.
    • Group Owner Notifications — Allows group owners to receive notifications of group membership changes.

      To see all Notifications type management roles in the web application, expand Identities and click Management Roles, then click the Type heading twice to sort descending.



      You can assign these management roles to any person, business role and location, group, or query-based collection. See Assigning Management Roles for more information.

  • Dynamic hierarchy alerts, if enabled and if the group is mail-enabled, are sent to the person, management role, or group specified in 
    • https://sso.empowersso.com/UI/#w/assignpeopletoalerts 



    • or https://sso.empowersso.com/UI/#w/assignmanagmentrolestoalerts 
    • or https://sso.empowersso.com/UI/#w/assigngroupstoalerts

Permanent workflows

Permanent workflows trigger some notifications. These workflows are disabled by default.

To access permanent workflows in the web application, expand Admin, then EmpowerID Servers and Settings, and click Permanent Workflows.

Request workflows

A request workflow is one that runs in response to a request by a person. Some request workflows send notifications that are necessary to ensure that EmpowerID runs smoothly. Some have optional approvals that you can enable as workflow parameters. 


Here is a list of request workflows with parameters that control notifications, along with their default values. (Twilio notifications are voice messages. For more, see Integrating Twilio.)

Request workflowWorkflow parameterDefault value
TemporaryGroupMembershipApprovalRequiredtrue
CreateScheduledCertificationAuditAuditDeletedNotificationEmailTemplateNameAuditDeletedNotificationEmail
CreateScheduledCertificationAuditAuditDeletedNotificationManagementRoleNameEmpowerIDSystemNotifications
UpdatePersonBusinessRolesDisableManagerPreApproval

false

UpdatePersonDirectAssignmentDisableManagerPreApprovaltrue
UpdatePersonManagementRolesDisableManagerPreApprovaltrue
CreatePersonDisableManagerPreApprovaltrue
CheckoutSharedCredentialDisablePreApprovalfalse
DeleteAccountWFEmailMessageID3041
SODViolationsExampleEmailMessageID35
CertificateExpirationNotificationEmailMessageID3008
NotifyAuditParticipantsEmailTemplateManagersOfPeopleWithUnfinishedTasksEmailTemplateNameForManagersOfPeopleWithUnfinishedTasks
AddBusinessProcessTaskCommentEmailTemplateNameBusinessProcessTaskComment
NotifyAuditParticipantsEmailTemplateNameForAllAuditParticipantsEmailTemplateNameForAllAuditParticipants
NotifyAuditParticipantsEmailTemplateNameForAnyoneWithUnfinishedTasksEmailTemplateNameForAnyoneWithUnfinishedTasks
UnreviewedRecertificationTaskNotificationEscalationEmailTemplateNameReviewer Recertification Escalation Email
CertificateExpirationNotificationLicenseEmailTemplateID3017
CreatePersonManagementRoleIDToEmail110
HelpdeskPasswordResetManagementRoleIDToEmail110
ResetPasswordManagementRoleIDToEmail110
SODViolationsExampleManagementRoleIDToNotify110
CertificateExpirationNotificationManagementRoleIDToNotify108
UnreviewedRecertificationTaskNotificationNotificationEmailTemplateNameReviewer Recertification Escalation Email
ElevateMeTemporarilyRetroActiveApprovalRequiredfalse
ResetPasswordSendAdminNotificationtrue
SendOTPAnonymousSendPasswordToEmailtrue
PasswordResetCenterSendPasswordToEmailfalse
SendPersonOneTimePasswordSendPasswordToEmailtrue
LoginWFSendPasswordToEmailtrue
RegisterAccountSendPasswordToEmailtrue
RegisterAccountSendPasswordToMobilefalse
LoginWFSendPasswordToMobilefalse
SendPersonOneTimePasswordSendPasswordToMobiletrue
PasswordResetCenterSendPasswordToMobilefalse
SendOTPAnonymousSendPasswordToMobiletrue
SendOTPAnonymousSendPasswordToPersonalEmailtrue
PasswordResetCenterSendPasswordToPersonalEmailfalse
SendPersonOneTimePasswordSendPasswordToPersonalEmailtrue
LoginWFSendPasswordToPersonalEmailtrue
RegisterAccountSendPasswordToPersonalEmailtrue
RegisterAccountSendPasswordToTwilioSMStrue
LoginWFSendPasswordToTwilioSMStrue
SendPersonOneTimePasswordSendPasswordToTwilioSMStrue
PasswordResetCenterSendPasswordToTwilioSMSfalse
SendOTPAnonymousSendPasswordToTwilioSMStrue
SendOTPAnonymousSendPasswordToTwilioVoiceCalltrue
PasswordResetCenterSendPasswordToTwilioVoiceCallfalse
SendPersonOneTimePasswordSendPasswordToTwilioVoiceCalltrue
LoginWFSendPasswordToTwilioVoiceCallfalse
RegisterAccountSendPasswordToTwilioVoiceCallfalse
ResetMultiFactorSendTwilioSMStrue
ResetMultiFactorSendTwilioVoiceCallfalse
CallMeSendTwilioVoiceCalltrue
ResetPasswordSendUserNotificationtrue
SendPersonOneTimePasswordSMSOTPKeyEntryNamePasswordResetCenterOTPSMSMessage
SendPersonOneTimePasswordTwilioOTPVoiceMessageTemplateNameTwilioOTPVoiceMessage
PasswordResetCenterTOTPTwilioOTPVoiceMessageTemplateNameTwilioOTPVoiceMessage
PasswordResetCenterOTPTwilioOTPVoiceMessageTemplateNameTwilioOTPVoiceMessage
PasswordResetCenterTwilioOTPVoiceMessageTemplateNameTwilioOTPVoiceMessage
RegisterAccountTwilioOTPVoiceMessageTemplateNameTwilioOTPVoiceMessage
LoginWFTwilioOTPVoiceMessageTemplateNameTwilioOTPVoiceMessage
PasswordExpirationNotificationUserPasswordExpirationWarningEmailMessageID1000
CallMeVoiceMessageTwilioOTPVoiceMessage



You can schedule re-notifications or manager escalations on individual workflows in the web application. Re-notifications send email to the task owner, and manager escalations send email to the task owner's manager.

  1. Expand Resources and click Workflows. (Search for "notif" to find workflows that specifically send notifications.)



  2. Click a workflow's Display Name, and on the Workflow Details page that appears, click the Edit icon.



    On the General tab, you can disable the workflow.


  3. Click the Schedule tab, and in the Task Owner Renotification section, you can enable and schedule re-notifications.




  4. In the Task Owner Manager Renotification section, you can enable and schedule manager notifications.

Email templates

You can find all of EmpowerID's email templates in the database in the EMailMessage table, or in the web application by expanding Admin, then Miscellaneous, and selecting Localized Emails. See Localized Emails for details on how to edit, translate, and create emails.

Email messages fall into several categories.


These emails are sent to people with the indicated management role. 

IDEmail template nameManagement roleRegarding
3007Job Failed Alert MessageEmpowerID System Notificationsfailed job name, system, server, and exception information
35SoD Violation NotificationEmpowerID Security Alertsrequest that caused a Separation of Duties violation
3005Group Membership Change Alert MessageGroup Membership Change Alerts 
Group Owner Notifications
accounts added or removed from group



These emails are sent when a new employee is added to the system.

IDEmail template nameSent toRequest workflow and parametersRegarding
1014Manager Preapproval Neededmanager of a new employee

CreatePerson
  DisableManagerPreApproval
  ManagementRoleIDToEmail

onboarding request
1023Validate Email Addressnew userCreatePersonlink to validate email address
1036Welcome Email for New Personnew userCreatePersonlogin credentials
1037Person Created Emailmanager of a new employeeCreatePerson
  ManagementRoleIDToEmail
new person information
1050Password Email to New Personnew userCreatePersonnew person password



You can enable alerts for Dynamic Group Policies (Hierarchies) when you create them. (They are off by default.) 

IDEmail template nameRegarding
1038Generic Hierarchy Create Group Messagenew group created for dynamic hierarchy policy
1039Generic Hierarchy Delete Group Messagegroup for dynamic hierarchy policy deleted
1040Generic Hierarchy Group Membership Changed Messagegroup membership for dynamic hierarchy policy changed
1043Generic Hierarchy Create Management Role Messagenew management role created for dynamic hierarchy policy
1044Generic Hierarchy Delete Management Role Messagemanagement role for dynamic hierarchy policy deleted
1045Generic Hierarchy Management Role Membership Changed Messagemanagement role membership for dynamic hierarchy policy changed
1046Generic Hierarchy Create Management Role Definition Messagenew management role definition created for dynamic hierarchy policy
1047Generic Hierarchy Delete Management Role Definition Messagemanagement role definition for dynamic hierarchy policy deleted
1048Generic Hierarchy Create Organization Unit Messagenew organization unit created for dynamic hierarchy policy
1049Generic Hierarchy Delete Organization Unit Messageorganization unit for dynamic hierarchy policy deleted

You can control which Dynamic Hierarchy change alert emails are sent in the web application.

  1. Expand Admin, then Policies, and click Dynamic Hierarchies.
  2. Edit each policy and scroll down to the Alerts section.


These emails are sent when rights to mailbox changes are detected and synced.

IDEmail template nameRegarding
3003Exchange Mailbox Permission Sync Receiver Notificationrights assigned to an Exchange mailbox
3010

Office 365 Mailbox Permission Sync Receiver Notification

rights assigned to an Office 365 mailbox



These emails are sent to individuals or their managers.

IDEmail template nameWorkflowRegarding
3008Certificate Expiration NotificationCertificateExpirationNotificationdate certificate will expire
3011Person Certificate Not Set Up
certificate is not set up
3013

AD Account Expiration Notification Message

ADAccountExpirationNotificationaccount about to expire
3014Person Expiration Notification MessagePersonExpirationNotificationperson about to expire
3016Group Membership Expiration Notification MessageGroupMembershipExpirationNotificationgroup membership has expired
3017License Expiration NotificationCertificateExpirationNotificationdate license will expire
3020Share External CredentialsAssetAccessRequestperson shared credential with you
3021Invite User To Join Organization MessageInviteUserToJoinOrganizationlink and one-time password to join organization
3022Create Partner Organization Welcome EmailCreatePartnerOrganizationWorkflowyour organization was created
3024Delegator Add Email NotificationUpdatePersonDelegatesperson was added as a delegate for you
3025Delegatee Add Email NotificationUpdatePersonDelegatesyou were added as a delegate for a person
3026Delegator Remove Email NotificationRemoveBusinessProcessTaskDelegateperson was removed as a delegate for you
3027Delegatee Remove Email NotificationRemoveBusinessProcessTaskDelegateyou were removed as a delegate for a person
3028Delegatee Attestation Email NotificationDelegateTaskperson delegated an attestation task to you
3036Persona Switch Email NotificationLoginWFperson logged into EmpowerID using your identity
3037Person Enrollment Email NotificationEnrollmentyour enrollment was successful
3046Invite User To Join Organization Using Magic URLInviteUserToJoinOrganizationPasswordlessLoginlink to complete registration
3053Invite User To Join Organization Passwordless Login EmailInviteUserToJoinOrganizationPasswordlessLoginlink to passwordless sign-in



This category contains emails that are sent to initiators and approvers of access and assignment requests.

IDEmail template nameSent toRegarding
1To Approver Pending - One Resourceapproverpending approval task for access to one resource
2To Initiator Approved - One Resourceinitiatoraccess request for one resource is approved
3To Initiator Rejected - One Resourceinitiatoraccess request for one resource is rejected
4Initiator Confirmation Screen - One Resourceinitiatorsubmit a request for access to a resource
5Approver Screen - One Resourceapproverapprove a request for access to a resource
6To Approver Pending - Two Resourcesapproverpending approval task for access to two resources
7To Initiator Approved - Two Resourcesinitiatoraccess request for two resources is approved
8To Initiator Rejected - Two Resourcesinitiatoraccess request for two resources is rejected
9Initiator Confirmation Screen - Two Resourcesinitiatorsubmit a request for access to resources
10Approver Screen - Two Resourcesapproverapprove a request for access to resources
11To Approver Pending - Three Resourcesapproverpending approval task for access to three resources
12To Initiator Approved - Three Resourcesinitiatoraccess request for three resources is approved
13To Initiator Rejected - Three Resourcesinitiatoraccess request for three resources is rejected
14Initiator Confirmation Screen - Three Resourcesinitiatorsubmit a request for access to resources
15Approver Screen - Three Resourcesapproverapprove a request for access to resources
16To Approver Pending - Management Role Assignmentapproverpending approval task for a management role assignment
17To Initiator Approved - Management Role Assignmentinitiatormanagement role assignment request is approved
18To Initiator Rejected - Management Role Assignmentinitiatormanagement role assignment request is rejected
19Initiator Confirmation Screen - Management Role Assignmentinitiatorsubmit a request for management role assignment
20Approver Screen - Management Role Assignmentapprover approve a request for assignment to a management role
21To Approver Pending - Multi Resources and Operationsapproverpending approval task for access to multiple resources and operations
22To Initiator Approved - Multi Resource and Single Operationinitiatoraccess request for multiple resources and an operation is approved
23To Initiator Rejected - Multi Resource and Single Operationinitiatoraccess request for multiple resources and an operation is rejected
24To Approver Pending - Multi Resources and Dual Operationapproverpending approval task for access to multiple resources and two operations
25To Initiator Approved - Multi Resource and Dual Operationinitiatoraccess request for multiple resources and two operations is approved
26To Initiator Rejected - Multi Resource and Dual Operationinitiatoraccess request for multiple resources and two operations is rejected
27To Approver Pending - Multi Resources and Triple Operationapproverpending approval task for access to multiple resources and three operations
28To Initiator Approved - Multi Resource and Triple Operationinitiatoraccess request for multiple resources and three operations is approved
29To Initiator Rejected - Multi Resource and Triple Operationinitiatoraccess request for multiple resources and three operations is rejected
30To Approver Pending - Create Application User Requestapproverpending approval task for creation of an application user
31To Initiator Approved - Create Application User Requestinitiatorcreation request for an application user is approved
32To Approver Pending - Create Generic Asset Requestapproverpending approval task for creation of a generic asset
33To Initiator Approved - Create Generic Asset Requestinitiatorcreation request for a generic asset is approved



These emails are sent to audit participants and their managers. You can disable these notifications, specify the frequency, and enable escalations when Creating Audits

You can find more information in Recertification Workflows

IDEmail template nameSent toWorkflowRegarding
3031Email Template Name for All Audit Participantsall audit participantsNotifyAuditParticipantstemplate that organizations can customize to send a message to all audit participants
3032Email Template Name for Managers of People with Unfinished Tasksaudit participant managersNotifyAuditParticipantstemplate that organizations can customize to send a message to all managers of audit participants with unfinished audit tasks
3033Email Template Name for Anyone with Unfinished Tasksaudit participant with unfinished tasksNotifyAuditParticipantstemplate that organizations can customize to send a message to audit participants with unfinished audit tasks
3034Reviewer Recertification Notification Emailaudit participant with unfinished tasksUnreviewedRecertificationTaskNotificationlist of unreviewed tasks
3035Reviewer Recertification Escalation Emailaudit participant with unfinished tasksUnreviewedRecertificationTaskNotificationlist of unreviewed tasks sent when escalation emails are enabled for an audit
3049Audit Deleted Notification Emailaudit ownerAuditNewfailure to create audit due to missing attestation policy



These emails are sent to managers regarding their direct report employees.

IDEmail template nameRegarding
1012Remove Person's Application Accesspending approval task for removal of an employee's access to an application
1016Vacation Request Approval Emailvacation request
1017Manager Escalation Notificationrequest by a direct report
3006Account Locked out Alert Messageaccount is locked out for a person



This category contains emails which are sent in relation to password changes.

IDEmail template nameSent toWorkflowRegarding

36

Helpdesk Password Reset NotificationuserHelpdeskPasswordResetpassword was reset by helpdesk
37Admin Password Reset NotificationadministratorHelpdeskPasswordResetuser's password was reset by helpdesk staff
1000Password Notification Email MessageuserPasswordExpirationNotificationpassword will expire
1002Password Expiration Email MessageuserPasswordExpirationNotificationpassword expired
1004Password Expiration Warning 91 DaysuserPasswordExpirationNotification
(Schedule tab)
password expired; account will be disabled in nine days if not changed
1006Password Violation Email MessageuserPasswordExpirationNotificationpassword expired; account will be disabled in one day if not changed
1008Password Expiration Account Disabled Email MessageuserPasswordExpirationNotificationaccount disabled; link to re-enable it
1010Password Manager Username RecoveryuserHelpdeskPasswordResetforgotten password; link to reset it
1011Password Manager Reset Passwordnew userCreatePersontemporary password
1013Employee New Passwordnew user's managerCreatePersontemporary password for their new employee
3004Changed Password Alert MessageuserChangePasswordpassword change success
3009

Person Locked out Alert Message

user
person has been locked out
3012

Twilio OTP Voice Message

userPasswordResetCenterOTPvoice delivery of one-time password using Twilio
3039Passwordless Login Email TemplateuserPasswordResetCenterOTPforgotten password; link to log in without a password
3042OTP Email MessageuserPasswordResetCenterOTPone-time password
3054Google Oath Token TemplateuserCreateTOTPTokenone-time password software token for Google Authenticator and instructions
3055EmpowerID Oath Token TemplateuserCreateTOTPTokenone-time password software token for EmpowerID Authenticator and instructions








concepts:

Overview of the EmpowerID Identity Warehouse

Overview of Inventory

Account Inbox Overview

Overview of Attribute Flow

Overview of Projection and Enforcement



tasks:

Managing User Accounts and Groups










In this article