ARS approval with MFA (sms /email)

[pmarvig]

Hi ,

Would like to explore the possibility of having additional control on Access request workflow in Saviynt. 

All ARS approval/rejection are done in Saviynt, we have some critical application access approval which we want to prevent from being approved by anyone with Saviynt Admin access or in the event Saviynt is comprised. Is it possible to have MFA like approval imbedded in the workflow   where the approver has to input token/code received via sms/email in order to complete the approval process. This would reduce the risk of unauthorize access approval in Saviynt.  

[DixshantValecha]

Hi @pmarvig,

We are checking on your request and we will keep you posted.

[pmarvig]

OTP should be the right term instead of MFA. ARS approval with  OTP 

[DixshantValecha]

Hi @pmarvig,

You are suggesting an additional security measure. You want the approver to receive a one-time password (OTP) via SMS or email, which you would need to input to complete the approval process correct?

[pmarvig]

Yes, was exploring on how to secure approval process, particularly for Privilege accesses.

We are looking into ways to prevent rogue users with Admin SAVROLE to request and approve Privilege Accounts.

SavRole Admin can approve on-behalf, modify workflows, disable any monitoring to external systems (SIEM) hence compromise of SAVROLE ADMIN may not be detectable until later.