...
There are three available policies:
- Deny: The type of change is immediately denied when a member of the User Group attempts to perform that action.
- Action to be Approved: The Submit Action: The type of change made by any user in the associated User Group will require an administrative user to approve the change (The approver must be included under a "Must Approve Action" group for the same action).
- Must Approve Action: A user from the group must approve the action for it to be removed from the "Pending" list, and successfully execute. If more than one group is assigned with the "Must Approve Action" policy for an action, all groups must have a user from that group approve the action for it to execute. If the change has only been partially approved, its status will be "Pending, awaiting approval from others" and no action will be executed until all groups have provided a response to the action.
- Deny Action: The type of change is immediately denied when a member of the User Group attempts to perform that action.
Ensure that for any group/action set with an "Action to be Approveda "Submit" policy, another group is set with "Must Approve" for the same family-action type. Failure to provide groups for both submitter and approver may result in changes not being processed, due to not having a user assigned to approve the request.
...
| Group 1A (Admin) | Group 1B | Group 1C |
|---|---|---|
Approval Group Settings:
|
Approval Group Settings:
|
Approval Group Settings:
|
...
| Expand | ||
|---|---|---|
| ||
These examples use the "Assign" button for the Group under the ApprovalsPermission Groups sub-tab, Groups page. Scenario 1 Group A:
Group B:
Group C, Deny Policy:
Group C, Action to be Approved Submit Policy:
These settings may also be set by Action Type instead of Group, from the Approvals Permission Groups sub-tab, Actions page. |
...
| Group 2A (Admin Approvers) | Group 2B (Admin Approver Bob) | Group 2C |
|---|---|---|
Approval Group Settings:
|
Approval Group Settings:
|
Approval Group Settings:
|
...
Review User Groups and Approval Process Needs
Expand Step 1 - Review Existing User Groups and Process Needs
When setting up Approvals for the first time, review the information in the previous section under "Approvals Fundamentals" to ensure a basic understanding of how Policies, Actions, and User Groups relate together in Approvals.
Then, take a few minutes to think about the following questions to get a better sense of how to use Approvals with your specific organization:
Expand Who are the users that perform DNS / DHCP tasks, and at what level?
Affects which users should be included in what User Groups
What ProVision User Group(s) are they in?
Approvals settings are applied to the User Group, not individuals - ensure users with similar oversight needs are grouped together
What actions made by a certain user group should be automatically denied, if any?
Assign the "Deny Action" policy to that Action/User Group combination
What actions made by a certain user group should require oversight (admin approval / rejection)?
Assign "Submit Action to be approved" to that Actionthat Action/User Group combination
Who is the admin / User Group that will make the final approval on a change?
Ensure the approver(s) is in a User Group with the "Must Approve Action" policy assigned for the actions requiring approval
Should any changes require multiple admins / User Groups to approve it in order to execute?
A single user from every group assigned with "Must Approve Action" for the action must approve the action for it to succeed
If two admins are required to both separately agree on a change, they should be under two separate User Groups assigned "Must Approve"
What User Groups would need to receive email Approval Status notifications, and on what type of actions?
Affects whether to enable notifications and set up the scheduler task to send the notifications, and to what User Groups. When enabled, all users of the relevant group(s) will receive the email(s)
Once your User Groups are optimized for use with Approvals, you may want to write down a quick note on which Action Types and policies are planned for each group.
Edit User Groups / Create Approvals-Specific User Groups, if needed
Expand Step 2 - Add or Edit ProVision User Groups
From here, depending on the answers to the questions in step 1, you may need to do one or more of the following from the Users tab:
- Edit existing User Groups to add or remove users, in order to combine users who will need similar action types approved.
- Verify the User Groups have appropriate CRUD permissions set to perform the action(s) to be approved (e.g, you may have previously removed "Create" permissions for a group, but if the intent is now for those users to have "Add" actions approved by an Admin, the submitter will need User Group resource "Create" permissions back!)
- Create new User Groups specifically for use with Approvals (recommended)
- Associate users with different, or additional User Groups (remember - users can be associated with multiple groups!)
For more information on adding and editing ProVision User Groups, see Users & Permissions, Global Permissions, and Working with Users.
Assign Action and Policy Settings to User Groups
Expand Step 3 - Assign Approval Action Settings to Groups
From the Approvals Tab, navigate to the Permission Groups sub-tab.
Then, under the Groups page tab, find the ProVision User Group you want to assign a policy to and click "Assign".
Clicking the "Assign" button for a group brings up a checklist to select what policy to apply to the group for what Family and Actions (i.e. DNS Zone 'Add' or DNS Group 'Update'). Select either "Deny Action", "Submit Action to be Approved", or "Must Approve Action" under Policy. Once you've selected a policy, you can "quick-select" all actions for a DNS Family (Severs, Groups, Zones, Records) by clicking the checkbox next to the family name, or only select individual action types for each Family.
When done, Click "Assign", and repeat as needed for other Policy types or User Groups.
If using Approvals notifications, enable notifications for the appropriate Permissions Group(s)
Expand Step 4 - Enable Notifications (Optional)
From the Approvals Tab, navigate to the Permission Groups sub-tab Groups page tab.
Click on the group name for which you want to set notifications - the Group Permissions Detail page will provide additional information on the group's settings.
For any Family/Action that you want to enable notifications, click the checkbox under "Enable Notifications". All users of that group will get email notifications when a change of the selected type(s) are made.
If using Approvals notifications, set up a Scheduler task for "Approvals - Process Subscription"
Expand Step 5 - Add Scheduler Task: "Approvals - Process Subscription"
The "Approvals - Process Subscription" task processes approval request events and handles the sending of notification emails to subscribed Approvals Groups - this task must be created and running on a regular interval in order for Approval Notification emails to be sent.
In order to receive the most up to date information in the Approval Notifications, is recommended to create this task with a run time of "every 5 minutes" and no end date.
For information on setting up Scheduler Tasks, see Scheduler.
Set up a Scheduler Task for "Approvals - Delete events older than 1 month", to occasionally clear out old and obsolete Approval request events
Expand Step 6 - Add Scheduler Task: "Approvals - Delete events older than 1 month"
The "Approvals - Delete events older than 1 month" task deletes any Approvals history events older than 30 days.
It is recommended to set this task to run monthly with no end date, to clear out obsolete approvals items, reduce data storage space needs, and reduce approvals page load time.
For information on setting up Scheduler Tasks, see Scheduler.
...