You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
# Request process and email notifications in Azure AD entitlement management
25
25
26
-
When a user submits a request to an access package, a process is started to deliver that request. Azure AD entitlement management also sends email notifications to approvers and requestors when key events occur during the process.
27
-
28
-
This article describes the request process, and the email notifications that are sent.
26
+
When a user submits a request to an access package, a process begins to deliver that access request. Azure AD entitlement management sends email notifications to approvers and requestors when key events occur during the process. This article describes the request process and the email notifications that are sent.
29
27
30
28
## Request process
31
29
32
-
A user that needs access to an access package can submit an access request. Depending on the configuration of the policy, the request might require an approval. When a request is approved, a process begins to assign the user access to each resource in the access package. The following diagram shows an overview of the process and the different states.
30
+
A user that needs access to an access package can submit an access request. Depending on the configuration of the policy, the request might require an approval. When a request is approved, a process begins to assign the user access to each resource in the access package. The following diagram shows an overview of the process and the different states:
33
31
34
32
35
33
@@ -47,42 +45,84 @@ A user that needs access to an access package can submit an access request. Depe
47
45
48
46
## Email notifications
49
47
50
-
If you are an approver, you are sent email notifications when you need to approve an access request and when an access request has been completed. If you are a requestor, you are sent email notifications that indicate the status of your request. The following diagram shows when these email notifications are sent.
48
+
If you are an approver, you are sent email notifications when you need to approve an access request and when an access request has been completed. If you are a requestor, you are sent email notifications that indicate the status of your request.
49
+
50
+
The following diagrams shows when these email notifications are sent to either the approvers or the requestor. Reference the [email notifications table](entitlement-management-process.md#email-notifications-table) to find the corresponding number to the email notifications displayed in the diagrams.
51
+
52
+
### Primary approvers and alternate approvers
53
+
The following diagram shows the experience of primary approvers and alternate approvers, and the email notifications they receive during the request process:
54
+
55
+
56
+
57
+
### Requestors
58
+
The following diagram shows the experience of requestors and the email notifications they receive during the request process:
53
61
54
-
The following table provides more detail about each of these email notifications.
62
+
### Email notifications table
63
+
The following table provides more detail about each of these email notifications. To manage these emails, you can use rules. For example, in Outlook, you can create rules to move the emails to a folder if the subject contains words from this table:
55
64
56
65
| # | Email subject | When sent | Sent to |
57
66
| --- | --- | --- | --- |
58
-
| 1 | Action required: Review access request from *[requestor]* to *[access package]* by *[date]*| When a requestor submits a request for an access package | All approvers |
59
-
| 2 | Action required: Review access request from *[requestor]* to *[access package]* by *[date]*| X days before the approval request timeout | All approvers |
60
-
| 3 | Status notification: *[requestor]*'s access request to *[access package]* has expired | When the approvers do not approve or deny an access request within the request duration | Requestor |
61
-
| 4 | Status notification: *[requestor]* access request to *[access package]* has been completed | When the first approver approves or denies an access request | All approvers |
62
-
| 5 | You have been denied access to *[access package]*| When a requestor has been denied access to the access package | Requestor |
63
-
| 6 | You now have access to *[access package]*| When a requestor has been granted access to every resource in the access package | Requestor |
64
-
| 7 | Your access to *[access package]* expires in X day(s) | X days before the requestor's access to the access package expires | Requestor |
65
-
| 8 | Your access to *[access package]* has expired | When the requestor's access to an access package expires | Requestor |
67
+
| 1 | Action required: Approve or deny forwarded request by *[date]*| This email will be sent to Stage-1 Alternate approvers (after the request has been escalated) to take action. | Stage-1 Alternate Approver |
68
+
| 2 | Action required: Approve or deny request by *[date]*| This email will be sent to Stage-1 Primary approvers, if escalation is disabled, to take action. | Stage-1 Primary Approver |
69
+
| 3 | Reminder: Approve or deny the request by *[date]* for *[requestor]*| This reminder email will be sent to Stage-1 Primary approvers, if escalation is disabled, to take action, only when they haven’t yet taken action. | Stage-1 Primary Approver |
70
+
| 4 | Approve or deny the request by *[time]* on *[date]*| This email will be sent to Stage-1 Primary approvers (if escalation is enabled) to take action. | Stage-1 Primary Approver |
71
+
| 5 | Action required reminder: Approve or deny the request by *[date]* for *[requestor]*| This reminder email will be sent to Stage-1 Primary approvers, if escalation is enabled, to take action, only when they haven’t yet taken action. | Stage-1 Primary Approver |
72
+
| 6 | Request has expired for *[access_package]*| This email will be sent to Stage-1 primary approvers and/or Stage-1 alternate approvers, of a single-stage or multi-stage request, after the request has expired. | Stage-1 Primary Approver, Stage-1 Alternate Approver |
73
+
| 7 | Request approved for *[requestor]* to *[access_package]*| This email will be sent to the stage-1 primary approvers and/or stage-1 alternate approvers, upon completion of a request. | Stage-1 Primary Approver, Stage-1 Alternate Approver |
74
+
| 8 | Request approved for *[requestor]* to *[access_package]*| This email will be sent to the stage-1 primary approvers and/or stage-1 alternate approvers, of a 2-stage request, only when stage-1 is approved. | Stage-1 Primary Approver, Stage-1 Alternate Approver |
75
+
| 9 | Request denied to *[access_package]*| This email will be sent to the requestor only when his request is denied | Requestor |
76
+
| 10 | Your request has expired for *[access_package]*| This email will be sent to the requestor at the end of Stage-1, of a single-stage or multi-stage request, after the request has expired. | Requestor |
77
+
| 18 | You now have access to *[access_package]*| This email will be sent to the end-users to start using their access. | Requestor |
78
+
| 19 | Extend access for *[access_package]* by *[date]*| This email will be sent to the end-users before their access expires. | Requestor |
79
+
| 20 | Access has ended for *[access_package]*| This email will be sent to the end-users after their access expires. | Requestor |
66
80
67
81
### Access request emails
68
82
69
-
When a requestor submits an access request for an access package that is configured to require approval, all approvers configured in the policy receive an email notification with details of the request. Details include the requestor's name, organization, access start and end date if provided, business justification, when the request was submitted, and when the request will expire. The email includes a link where approvers can approve or deny the access request. Here is a sample email notification that is sent to an approver when a requestor submits an access request.
83
+
When a requestor submits an access request for an access package configured to require approval, all approvers added to the policy will receive an email notification with details of the request. Details include the requestor's name, organization, access start and end date (if provided), business justification, when the request was submitted, and when the request will expire.
84
+
85
+
The email includes a link approvers can click on to go to Myaccess to approve or deny the access request. Here is a sample email notification that is sent to an approver when a requestor submits an access request:
86
+
87
+
88
+
89
+
The primary approvers are also sent an email notification with a reminder to take action and make a decision for the request. Here is a sample email of the notification primary approvers receive to remind them to take action:
If forwarding to alternate approvers is enabled, per the forwarding policy, if the request is still pending, the request will be forwarded. The alternate approver will receive a notification email to approve or deny the request. Here is a sample email of the notification the alternate approvers receive:
Both, the primary approvers and the alternate approvers can approve or deny the request.
72
100
73
101
### Approved or denied emails
74
102
75
-
Requestors are notified when their access request is approved and available for access, or when their access request is denied. When an approver receives an access request submitted by a requestor, they can approve or deny the access request. The approver needs to add a business justification for their decision.
103
+
Requestors are notified when their access request is approved and available for access, or when their access request is denied. When an approver receives an access request submitted by a requestor, they can approve or deny the access request. The approver needs to add a business justification for their decision. Here is a sample email sent to primary or alternate approvers after a request is approved:
When an access request is approved, and their access is provisioned, an email notification is sent to the requestor that they now have access to the access package. Here is a sample email notification that is sent to a requestor when they are granted access to an access package:
76
108
77
-
When an access request is approved, entitlementmanagement starts the process of granting the requestor access to each of the resources in the access package. After the requestor has been granted access to every resource in the access package, an email notification is sent to the requestor that their access request was approved and that they now have access to the access package. Here is a sample email notification that is sent to a requestor when they are granted access to an access package.
When an access request is denied, an email notification is sent to the requestor. Here is a sample email notification that is sent to a requestor when their access request is denied.
111
+
When an access request is denied, an email notification is sent to the requestor. Here is a sample email notification that is sent to a requestor when their access request is denied:
Requestors are notified when their access request has expired. When a requestor submits an access request, the request has a request duration after which it expires. If there are no approvers who submit an approve/deny decision, the request continues to remain in a pending approval state. When the request reaches its configured expiration duration, the request expires, and can no longer be approved or denied by the approvers. In this case, the request goes into an expired state. An expired request can no longer be approved or denied. An email notification is sent to the requestor that their access request has expired, and that they need to resubmit the access request. Here is a sample email notification that is sent to a requestor when their access request has expired.
117
+
Access requests could expire if no approver has approved or denied the request.
118
+
119
+
When the request reaches its configured expiration date and expires, it can no longer be approved or denied by the approvers. Here is a sample email of the notification sent to all of the primary and alternate approvers:
An email notification is also sent to the requestor, notifying them that their access request has expired, and that they need to resubmit the access request. Here is a sample email notification that is sent to a requestor when their access request has expired:
0 commit comments