Take action when an approval request is denied

Question

Hello,

We have a script that checks for expiring accounts (temp/contractor) and emails the users manager requesting that they respond to the email either approving an extension of the account for another 90 days, or the termination of the account.

We also have a custom task that our security group uses to extend the account for 3 months.

What we would like to do, is use Adaxes to generate an approval request to the manager, have the manager log into the self service website, then click approve or deny. I can see how to do the approval, but is there any way to trigger an action if the manager clicks deny? If they do deny it we want to deprovision the account after it has expired, or at least send an email to the security group to do so.

Answer 1

Hello,

Since, if the Approval Request is denied. the account will expire, you can create a Scheduled Task that will run, say, daily and that will execute the Custom Command used for deprovisioning on every user, whose account has expired. To implement such a solution:

1. Create a new Scheduled Task.
2. On the 3rd step of the Create Scheduled Task wizard, select the User object type.
   
3. On the 4th step, add the Execute a Custom Command action.
4. Click Select.
   
5. In the dialog box that appears, select the Custom Command that you use for user deprovisioning and click OK two times.
6. Click the Add Condition button.
   
7. Select the If account/password <expiration status> condition.
8. Select If the User account has expired.
   
9. Click OK and finish creation of the Scheduled Task.

Comments

What if the approval is not denied and is just ignored? Will it be removed with the object?

I was thinking about this post on my way to lunch today. Wouldn't it be easier for it to be in one scheduled task?

use an available attribute

Action 1
1. Look for expiring accounts that will expire in ** days and where attribute is blank
2. Set attribute to {something}
3. Set account expiration to +3 months (Require Approval)

Action 2
1. Look for accounts that expired * days ago and where attribute is not blank
2. Deprovision account

With this, if the manager does not approve or does deny the request for the account, then it is deprovisioned. The only concern I have here is that when you get over 1000 pending approvals, Adaxes gets slower and if you have managers\users like I do, then they will ignore requests that they are not concerned with.

---

Hello,

The only issue here is that you cannot find the specific Approval Request that requires to approve a specific action. However, it is possible to find all pending requests that require approval of operations on a specific user. So, I suggest a Scheduled Task with two sets of actions and conditions:

1. • If account will expire in less than ** days
   • Set account expiration to +3 months (Requires Approval)
2. • If account has expired ** days ago
   • Deprovision account
   • Run a PowerShell script that finds all pending Approval Requests that request approval for operations on the account and deny them.

If this solution is OK with you, see Managing Approval Requests for information on how to manage Approval Requests in scripts. If you need assistance with the script, we will help you.