Approval in limbo

Question

We need to have the account created but the manager is not available to approve.
How can we force the account to be created?

Comments

I found the option under the Approval Request.
Since we had to change the process because of more testing, if I approve the account, will it now take the process of whats in place?(which is to update address, send notification, and add to group).

I just want to make sure since this will be an actual account. Also, once approved, what would the manager see?

Answer 1

Hello,

Service administrators can approve or deny any request. So, if you have appropriate permissions, you can either approve the request or add another person to the list of request approvers. For more details, see Managing Approval Requests.

if I approve the account, will it now take the process of whats in place?(which is to update address, send notification, and add to group).

Yes, sure. All your Business Rules will be triggered after the operation is approved.

Also, once approved, what would the manager see?

The manager will see that the request is approved by somebody else.

Comments

will these approvals ever expire if it isn't addressed?

---

Hello,

No, they won't expire. Approval Requests will remain Pending until approved, denied or canceled.

---

Howdy!

Within the approval option on the web interface, the request initiator and processee email or rather their samAccount isn't reflected correctly. Its showing the former SMTP.
How can I change/update to reflect the correct SMTP?

---

Hello,

Can you post here or send us a screenshot of what's wrong.

---

screenshot sent.

Thanks

---

Email received, thanks. We've asked our QA guys to investigate the issue and will update you as soon as they come up with something.

---

Hello,

The thing is that there exist two types of a User principal Name (UPN):

• implicitly defined UPN: an implicit UPN is always of the form UserName@DNSDomainName.com, where UserName is the Windows Logon Name (pre-Windows 2000) of the user, and DNSDomainName.com is the DNS name of the user's domain. It is not assigned explicitly, it is always unique for every user, and the part of implicit name after the @ sign is always the domain DNS name.
• explicitly defined UPN: has the form of Name@Suffix, where both the name and the suffix are explicitly defined by the administrator. An explicitly defined UPN is not required to be unique, moreover, it is not necessary for a user to have an explicitly defined UPN.

For more information on implicit and explicit UPNs, see the following article by Microsoft: http://msdn.microsoft.com/en-us/library ... cipal_name.

Since implicit UPN is always unique, and explicit UPN is not, we always use the implicit UPN to display users in details of Approval Requests so that it would always be possible to find the necessary user.

---

ok thanks.

---

Howdy Folks-

Need a suggestion for HR.

They want to be able to have a backup approver within HR in the event the manager is out of town etc.
I'd suggested they delegate approvers, but in the case they ask that those approvers have the ability to modify accounts, what would be the best way to solve this?
create a second security role?

---

Hello,

We don't quite understand the second part of your requirements, can you please clarify?

I'd suggested they delegate approvers, but in the case they ask that those approvers have the ability to modify accounts, what would be the best way to solve this?

1. You suggested to pass the passwords to the accounts of the approvers to the HR so that the HR can login as an approver and process requests while approvers are out of town. However, this raised a concern that the HR could thus gain certain permissions that they shouldn't have (like modifying accounts), and you'd like to somehow evade this situation.
2. In addition to simply approving/denying requests, the HR need additional permissions that the original approvers have.

Which one is correct?

---

We do not recommend passing of passwords to anyone.
My suggestion was for HR to decide backup approvers, so I can then either put them in a group or OU, and then add them into the approval process in the event the Manager is out of the office.
In the event HR want those same persons to make changes to accounts, would creating a another security role suffice?

Currently we do have it setup for HR(a select few) to create accounts as part of the new hire process...and also disable as part of the termination. So currently they are created accounts, modifying etc.

---

Hello,

Temporary Approvers:

We suggest the following solution:

1. In the Business Rule(s) that sends operations for approval, you can specify the necessary approvers (managers) as possible approvers. Also, you can add the guys from your HR who can approve requests while managers are out of office.

2. You can use a certain property of the managers' user accounts to serve as a flag that the managers are currently not available and someone else can process Approval Requests for them. For this purpose, you can use one of Adaxes virtual properties. Such properties are not stored in AD, but you can use them as any other properties of directory objects. For example, you can use CustomAttributeBoolean1 that can store boolean (True/False) values.
   **- OR -**
   If you use Exchange in your organization, and your managers set an Out-Of-Office (OOF) message when they are not available, you can use the OOF feature as a flag:

   • OOF enabled - HR can process requests instead of managers,
   • OOF disabled - HR cannot process requests instead of managers,

3. You can create a Business Rule triggered Before Updating an Approval Request. Since processing (approving, denying, canceling) an Approval Request means updating it, the Business Rule will be triggered once anyone tries to process an Approval Request.

4. The Business Rule will behave as follows:

   • If managers try to Approve or Deny an Approval Request, it will allow them to do this in any case.
   • If someone from the HR tries to Deny or Approve a Request, it will check the flag whether managers are out of office. If the flag is set to True, it will allow to process the Request, if not, it will cancel any attempt to process it.

If you are OK with such a solution, we will provide you with the necessary details and the script required to accomplish the task.

Additional Permissions for HR:

Yes, creating another Security Role that grants the HR only the necessary permissions and correctly assigning it should suffice.