New Account and Access workflow

[SavUser1]

Requirement :

1. When a user raises a request for application abc then a request will be created which will have new account and other access which needs to be approved by entitlement owner.

I am using below workflow but the new account is getting auto approved and a task for new account is created in Pending task. I need the task to be go through the same approval process as set for access. Is there any configuration that needs to be set.?

[rushikeshvartak]

Use 

ars_requests.requesttype == 3 or entitlement.entitlement_value != null

Refer https://forums.saviynt.com/t5/identity-governance/workflow-logic-issues-separating-new-account-and-a... 

[SavUser1]

I tried with below and the one you mentioned above but still the new account is getting auto approved instead of following the approval process...

((ars_requests.requesttype==3) and (entitlement != null))

[rushikeshvartak]

Its or condition 

ars_requests.requesttype == 3 or entitlement.entitlement_value != null

[NM]

Hi @SavUser1 , you can't send account approval to entitlement owner as account doesn't have anything related to it.

[rushikeshvartak]

You can send

[SavUser1]

It is not working, the new account is getting auto approved.

Following are the steps :

1. Condition if else - ((ars_requests.requesttype==3) or (entitlement.entitlement_value != null))
2. Condition If else - entitlement.customproperty8 eq 'TwoStepApproval'
3. Access Approval  - Owner having rank 1.

Is the access approval only works for access and not for account ?

[Raghu]

@SavUser1  workflow type should be parallel , if not check again

[rushikeshvartak]

• Share workflow wiring screenshot

[SavUser1]

Here is the screenshot. 

[rushikeshvartak]

1. Condition if else - ((ars_requests.requesttype==3) or (entitlement.entitlement_value != null))
2. Condition If else - ((ars_requests.requesttype==3) or (entitlement.entitlement_value != null and entitlement.customproperty8 eq 'TwoStepApproval'))

[SavUser1]

The account is again auto approved.

Below is the flow (highlighted)

[rushikeshvartak · Accepted solution]

Ideally if u need both accounts and access approval then if else block is not needed and instead of access approval use custom assignment block with custom query

select distinct eo.userkey
from entitlement_owners eo INNER JOIN request_access ra ON ra.ACCESSKEY=eo.entitlement_valuekey
where ra.REQUESTKEY=${ARSREQUEST.id}

[dgandhi]

Is it Serial WF or Parallel WF?

[SavUser1]

It is parallel.