LosJ.77330 (Customer) asked a question.
Workflow for group assignment approval?
Is it possible to create an Okta workflow that will send an approval to a non admin user for approval on adding someone to a certain group?
Basically i have another workflow used by our sales team that is kicked off when a user is assigned to a group, but right now i have to manually add the user to the group when i receive a ticket from the sales team member. Id like to remove myself from the equation and create a workflow that people can kick off and acts as a request to be added to a group and have this sales team member receive the approvals and then they get added to the group, thus kicking off my workflow, and automating the process fully
It sounds like you are describing the functionality of the Okta Identity Governance offering which provides access request options with approvers and actions such as adding users to a group (permanently or for a period of time).
is there anywhere I could find an example or explanation on how to set this up?
@LosJ.77330 (Customer) -- This is its own offering you would want to talk with your CSM or Account Executive.
Here is a link to its documentation. It provides Access Requests and Access Certification functionality.
See: https://help.okta.com/en-us/Content/Topics/identity-governance/iga-overview.htm
Hi CL. There internal Okta request/approval model isn't exposed as an API, so you are looking at rolling something yourself.
I haven't thought it through fully, but you could look at the new functionality for delegated workflows. That allows users that don't have access to Workflows console to run workflows and leverage fields for data input.
https://help.okta.com/wf/en-us/Content/Topics/Workflows/build/build-delegated-flow.htm
So the notification part should be easy. Trigger notification to the Sales team that requires approval. Have it include a link and/or instructions to the Okta console.
Setup a delegate workflow that the Sales team have access to. Allow them to enter the user ID and potentially the group ( or have a del w/flow per group ). This is effectively the approval step. They login to Okta, plug in the details needed and hit the button. User is added to group.