Before
IAM staff likely looked up the employee’s current account and group memberships, separated ordinary entitlements from exceptions, and prepared a review for the new manager. They then created the attestation task and contacted the manager manually, creating separate handoffs between access analysis, ticket preparation, and notification.
How it works
- A profile change triggers an account lookup and retrieves the employee’s current group memberships.
- Relevant inherited access is classified as KEEP, REMOVE, or CONFIRM, with administrative groups requiring confirmation.
- A manager attestation task is opened and the incoming manager receives a Teams notification with a 30-day review period.
Workflow details
- Trigger and account lookup: A profile update starts the workflow with the employee identity, former and new departments, and incoming manager, then retrieves the current account details.
- Access inventory: The workflow reads the employee’s group memberships and excludes birthright groups from the review, focusing on requested or manually assigned access associated with the former role.
- Automated classification: Each relevant group is listed with a reason and classified as KEEP, REMOVE, or CONFIRM; administrative groups are always marked CONFIRM for explicit manager validation.
- Manager attestation: The proposed access review is written into a ServiceNow attestation task assigned to the incoming manager, including the department change and a 30-day grace period.
- Notification and handoff: A message is posted to the designated Teams attestation channel with the employee, department transition, task number, and review period. The workflow ends after opening the task and sending the notification.
What changed
The access inventory, review classification, task creation, and manager notification now occur in one workflow after the profile change. The incoming manager receives a named review task and Teams message, while the human decision to validate or reject access remains with the manager.
Work removed
Looking up the changed employee, gathering current group memberships, separating birthright from role-related access, classifying each relevant group, preparing the attestation task, and manually notifying the incoming manager.
Expected outcome
Each role change produces a documented manager review and notification while removing at least two recurring manual handoffs: preparing the attestation task and contacting the reviewer.
