Group Membership Audit Workflow

Question

Would it be possible to utilize Adaxes' out of the box approval workflow functionality to accomplish the following audit process?

On a periodic basis, each group member's manager is emailed to confirm that their membership in that group is still valid. Ideally a non-response would count as an approval, but a reject would remove the user's group membership. Ultimately the goal is to help with maintaining least privileged principles as access is often granted, but rarely revoked.

Answer 1

Hello,

Unfortunately, there is no such possibility.

As a solution, you can use the following scenario:

1. A Scheduled Task will attempt to remove all members from the group.
2. A Business Rule triggering Before Removing a member from a Group will send an approval request to the user being removed from the group by executing a PowerShell script.
3. If the user denies the request, they will remain in the group. If the user approves the request, they will be removed from the group.

Comments

Hi yourpp - we have a similar situation and I was wondering if you discovered any other options for your use case?

Regards,
Bernie

---

No, not yet. The method proposed by Adaxes isn't trivial because they do not appear to have a native option to specify the affected user's manager for approval, only the requester's manager or owner of the group, etc. Ideally you would be able to use a template for the list of approvers, but cannot at this time, hence the need for a powershell script. To keep it simple, we will probably just use a scheduled task to email the manager with a list of each of their direct reports in the specified group and if they reply, a ticket will be generated in our help desk system and our staff will manually remove the membership.