Request Approval Activity - microsoft/MIMWAL GitHub Wiki
The Request Approval activity extends the Approval activity shipped with MIM / FIM to enable powerful WAL capabilities such as rich lookup grammar, dynamic / runtime lookup of all activity properties and conditional execution.
These capabilities make it possible to implement the following relatively common use cases very easily:
- Skip approval using 'Activity Execution Condition' and a single policy and single workflow instead of what would otherwise need multiple policies and workflows.
- Dynamically query template names and send approval notification using approver's preferred language.
- Dynamically set approval duration / approval threshold, e.g. 3 working days, calculating real duration due to holidays and weekends
- Dynamically require escalated approvers depending on the Job Title / HR Level of the first level approver.
Optional. Name of the activity to be displayed on the MIM / FIM workflow designer.
Optional. The condition which must be satisfied for execution of this activity's core task (i.e. create an approval request). This can be any WAL function expression resolving to a boolean value. e.g. Not(Eq([//Requestor],[//Target/Manager])). See Activity Execution Condition wiki for more information.
Required. This is a list of users and/or groups who can approve this request. Specify a search filter, a lookup or function expression or a ';' delimited list of email addresses. e.g. [//Target/Manager].
Required. This is the number of approvers required. Specify a lookup or function expression or a number. The default is 1 approver.
Required. This is the number of days before escalation and time out. Specify a lookup or function expression or a number. The default is 7 days.
Optional. The list of Users and / or groups who can approve this request after it has been escalated. Specify a search filter, a lookup or function expression or a ';' delimited list of email addresses. e.g. [//Target/Manager/Manager].
Required. The email template used to send email to approvers. Specify a search filter or a lookup or function expression. The default is: /EmailTemplate[DisplayName='Default pending approval email template'].
Optional. The email template used to send email to escalated approvers. Specify a search filter or a lookup or function expression.
Required. The email template used to send email to approvers to notify them that the approval is actioned. Specify a search filter or a lookup or function expression. The default is: /EmailTemplate[DisplayName='Default completed approval email template'].
Required. The email template used to send email to the requestor to notify them that the request is rejected. Specify a search filter or a lookup or function expression. The default is: /EmailTemplate[DisplayName='Default rejected request email template']
Required. The email template used to send email to the requestor to notify them that the request is timed out awaiting approval. Specify a search filter or a lookup or function expression. The default is: /EmailTemplate[DisplayName='Default timed out request email template']
The activity internally uses the Approval activity shipped with MIM / FIM to create the approval request, so its core task of sending approval request is bound by the specifications, property validation and any other limitations of the OOB Approval activity.
The following Request Approval activity sends the approval request to the members of "All RSA Administrators" set when the request is not from user's manager:
| Activity Display Name | Request Approval from RSA Admins |
| Activity Execution Condition | Not(Eq([//Requestor],[//Target/Manager])) |
| Approvers | /Set[DisplayName = '!All RSA Administrators']/ComputedMember |
| Approval Threshold | 1 |
| Duration | 7 |
| Pending Approval Email Template | /EmailTemplate[DisplayName='!RSA SecureID Account Approval and Provisioning Email Template'] |
| Completed Approval Email Template | /EmailTemplate[DisplayName='!RSA SecureID Account Completed Approval Email Template'] |
| Rejected Request Email Template | /EmailTemplate[DisplayName='!RSA SecureID Account Rejected Request Email Template'] |
| Timed out Request Email Template | /EmailTemplate[DisplayName='!RSA SecureID Account Timed out Request Email Template'] |
The following Request Approval activity sends the approval request to the requestor's manager in their preferred language if it's populated else in English:
| Activity Display Name | Request Approval from RSA Admins |
| Approvers | [//Requestor/Manager] |
| Approval Threshold | 1 |
| Duration | 7 |
| Pending Approval Email Template | /"EmailTemplate[DisplayName='!RSA SecureID Account Approval and Provisioning Email Template - " + IIF(IsPresent([//Requestor/Manager/xPreferredLanguage], [//Requestor/Manager/xPreferredLanguage], "en")) + "']" |
| Completed Approval Email Template | /"EmailTemplate[DisplayName='!RSA SecureID Account Completed Approval Email Template - " + IIF(IsPresent([//Requestor/Manager/xPreferredLanguage], [//Requestor/Manager/xPreferredLanguage], "en")) + "']" |
| Rejected Request Email Template | /"EmailTemplate[DisplayName='!RSA SecureID Account Rejected Request Email Template - " + IIF(IsPresent([//Requestor/xPreferredLanguage], [//Requestor/xPreferredLanguage], "en")) + "']" |
| Timed out Request Email Template | /"EmailTemplate[DisplayName='!RSA SecureID Account Timed out Request Email Template - " + IIF(IsPresent([//Requestor/xPreferredLanguage], [//Requestor/xPreferredLanguage], "en")) + "']" |
Note: The above example requires that templates for all possible preferred languages are mandatorily configured, so this example is more of academic nature. To handle defaults in a much more robust way, a production implementation is likely to use a Update Resources activity to populate email templates in
WorkflowDatadictionary that this activity will consume.