Question

How to deal with approval requests in a AD and AAD environment?

I have recently created a workflow where I log on as a AD user and request to be a member of a AAD group, the workflow works and sends a approval request.

The problem however is that the AAD user (manager of AAD group) receive the approval request. If I log on with that user it logs me on as the AD user and not AAD user. Adaxes makes no effort in "combining" the user accounts to my knowledge.

How do I deal with this?

I might as well note that if I as a admin approves the request, the adding of member works despite the initial request was based on a AD user and not a AAD user.

Answer 1

Hello Daniel,

This behaviour is by design. Also, you should know that for now, Azure AD users cannot log in to Adaxes. As such, you should only specify on-premises AD users as approvers.

Comments

I think I might have been unclear.

The initiator/requestor is a synchronized user, has both AD and AAD user accounts. Both are in Adaxes.

The approver is a synchronized user, has both AD and AAD user accounts. Both are in Adaxes.

The security group is purely AAD based, has the approver as manager.

When logging on as the approver the approval is nowhere to be seen because Adaxes treats the AD and AAD as two different user accounts.

Is this still impossible?

---

Hello Daniel,

Yes, that is correct. The accounts are treated as separate ones. The Azure AD account is specified as the approver, but you log in with the credentials of the on-premises AD account. As such, the logged on user is not the approver and does not see the request.

---

I understand from your answer that you understand the dilemma but what is the answer to the problem?

Is there a workaround?

Is it simply not supported right now?

---

Hello Daniel,

As we mentioned in the initial reply, you can specify Azure AD users as approvers for requests in Adaxes and it will work just fine. The thing is that they will never be able to process the requests as they are not allowed to log in to Adaxes. There is currently no workaround for the behavior.