Pre-approving access

Let an approver grant a principal automatic, pre-approved access ahead of time, so future requests within the configured window need no manual review.

Approvers can pre-approve access before the requestor creates an access request. Pre-approvals created this way appear on the Pre Approvals tab of Access Management, once your organization has it enabled.

For instance, the approver may want to allow certain users to elevate their permissions automatically for the duration of a project, without having to wait for the approver to approve manually every time.

When a user requests access that is automatically approved by an existing preapproval, the granted access duration is limited to the shortest of:

• Your tenant's maximum session duration

• The duration requested by the user

• The time remaining before --end

Allowing access ahead of time

To allow access requests for the future, use the /p0 allow slash command in Slack.

The arguments for this command are similar to /p0 request (see Using Slack slash commands), with a few additional required options:

• --to <email> Use the email identifier of the principal to which you want to grant access

• --end <timestamp> When the auto-approval window closes. Use a future date in ISO 8601 format or a common date format, like '2031-01-01T00:00:00Z' or 2031-01-01.

Optionally you can specify the --start option, which is the start time for auto-approved access. Defaults to now if not specified. Use the same format as --end.

The principal issuing the allow command must be a valid approver for the principal in the --to argument, and for the resources specified, based on the rules configured in Policy Studio.