PingOne Privilege

Managing access requests

An organization administrator can perform the following actions on a user’s just-in-time (JIT) access requests:

Additionally,

To manage requests, click Access Requests.

The page is organized into several tabs: Pending Requests, Approved Requests, History, and Auto Approve.

Manually approving pending requests

The Pending Requests tab lists all submitted requests that are awaiting a decision.

  1. In the PingOne Privilege admin console, go to Access Management > Access Requests.

  2. Click the Pending tab.

  3. Click View Details on a request to examine its contents.

  4. Review the request details:

    • Requester name and email

    • Requested resources

    • Requested duration

    • User comments

  5. Click Approve or Reject.

    The user is notified of the decision in their user portal. If Slack notifications are enabled, a message is also sent to the configured Slack channel.

Viewing approved requests

The Approved Requests tab displays all active sessions. Click any request to view its details.

Revoking access

An administrator can end an approved session manually before its scheduled expiration.

  1. In the PingOne Privilege admin console, go to Access Management > Access Requests.

  2. Click the Approved tab.

  3. In the list, find the active request you want to revoke.

  4. Click View Details to open the request.

  5. Click Close to terminate the session. Access to the resources is instantly revoked.

Viewing request history

The History tab lists all past requests, including approved, closed, and expired ones. The available filters are time and user.

Managing auto-approval policies

The Auto Approve tab lists all active auto-approval policies.

Configuring an auto-approval policy

While approving a user’s requests, you can create a policy to automatically approve similar requests:

  1. During the manual approval process for a user’s request, select the Auto-approve future requests checkbox.

  2. Specify the maximum duration for which future requests can be auto-approved.

  3. Add any comments for auditing purposes and click Approve.

An auto-approval policy is generated for that user and is listed in the Auto Approve tab.

Deleting an auto-approval policy

To delete an auto-approval policy:

  1. In the PingOne Privilege admin console, go to Access Management > Access Requests.

  2. Click the Auto Approve tab.

  3. In the list, find the auto-approval you want to delete.

  4. Click View Details to open the policy.

  5. Click Delete Auto-Approve Policy to remove the policy.

Removing access to a resource

The following process removes a user’s access to an individual resource:

  1. Delete the approval request associated with the resource.

  2. Delete the policy associated with the approval. Learn more about policies in Managing policies.

  3. Delete the auto-approval policy if the access is granted through an auto-approval process.

Revoking access to all resources

You can revoke a user’s access to all resources either permanently or temporarily. You may want to permanently revoke access if a user reports their device stolen. Otherwise, you may want to temporarily revoke access while the operating system of the device associated with a user is being patched.

To revoke a user’s access to all resources:

  • Permanently:

    1. In the PingOne Privilege admin console, go to Directory > Devices.

    2. In the list, find the device to delete and click View Details.

    3. Click Remove Device.

    4. Confirm the action by click Remove.

  • Temporarily:

    1. In the PingOne Privilege admin console, go to Directory > Devices.

    2. In the list, find the device to delete and click View Details.

    3. Toggle off Active Device.

      This deactivates all access for that user from that device.

    4. When you want to reactivate, toggle Active Device on again.