Before
IAM staff likely had to look up the requester and application, contact the manager and application owner, and wait for both decisions. They then manually changed and checked group membership, updated the request record, tracked any temporary expiry separately, and communicated the result.
How it works
- Read the requester and application, identify the manager and application owner, and send the manager approval request.
- If the manager approves, request owner approval; record and communicate either refusal without changing access.
- After both approvals, add and verify group membership, record temporary-access duration when supplied, close the ServiceNow request, and notify the relevant channel.
Workflow details
- Request intake: A ServiceNow access request starts the workflow with the requester, application, target group, justification, request record, and optional temporary-access duration. The workflow reads the requester and application details before beginning approval.
- Approval controls: The requester’s manager receives an approval request in Teams, followed by the application owner when the manager approves. Either refusal stops provisioning, records the rejection in ServiceNow, and posts the outcome to Teams.
- Provisioning: Access is added to the requested application group only after both approvals are granted. The workflow then checks the requester’s group memberships to verify that the access change is present.
- Temporary access: When a duration is supplied, the workflow creates an active temporary-grant record with the user, group, request, and duration details. Permanent access follows a separate path without creating an expiry record.
- Closure and communication: ServiceNow is updated with the approvals, refusal or grant status, group result, and relevant work notes, while Teams receives a confirmation. Temporary-access details are documented for the separate automatic-revocation process referenced by the workflow.
What changed
Approval sequencing, refusal handling, membership verification, ServiceNow updates, temporary-grant recording, and Teams notifications now occur automatically, while the manager and application owner retain the approval decisions.
Work removed
Looking up requester and application details, sending and chasing two approval requests, recording refusals, adding the user to a group, checking membership, updating request notes and state, creating temporary-grant records, and posting access confirmations.
Expected outcome
Conservatively, the workflow can remove roughly five to seven recurring manual handoffs or checks per access request while leaving a traceable approval and provisioning record.
