To enable access control policy

1. Navigate to Multiperson authorization.
2. Click Enable.
3. Confirm the change.

To edit an access control policy

1. Navigate to Multiperson authorization.
2. Click Edit.
3. You can update any of the following fields:

   • Send requests to: Specify a comma-separated list of email addresses for notifications.

   • Expire pending requests after: Set the period (in hours) after which any pending requests will expire.

   • Delete resolved requests after: Specify the period (in days) after which resolved requests will be deleted.

4. Click Save.

To disable access control policy

1. Navigate to Multiperson authorization.
2. Click Disable.
3. Provide a reason in the pop-up and click Disable.

Viewing multiperson authorization requests

1. On the Home page, select View requests in the Multiperson authorization widget.
2. The Request management page lists all your requests for operations that require multiperson authorization. You can apply filters to view requests that you have submitted, requests sent to you for approval, and to narrow results by time frame or request status.
3. Select the request ID to see the request details. The Audit trail tab gives more details on the status of your request.
4. Select the Preview request details tab to see the changes that have been made as part of the request.

   The requester can cancel his request by selecting Cancel request.

To manage multiperson authorization requests

1. On the Home page, select My actions in the Multiperson authorization widget.

   You can also click on the User icon on the top right corner. In the pop-up, select the View authorization request option.

2. The Request management page lists all the requests for operations that require multiperson authorization. You can apply filters to view requests that you have submitted, requests sent to you for approval, and to narrow results by time frame or request status.
3. Select the request ID to see the request details. The Audit trail tab gives more details on the request. The Preview request details tab to see the changes that have been made as part of the request.
4. Select Approve if you want to approve the request. In the Approve request pop-up, provide the reason for approving the request. Click Approve to complete the approval.

   Select Reject if you want to reject the request. In the Reject request pop-up, provide the reason for rejecting the request. Click Reject to complete the rejection.

   The reason field can contain 8 - 256 characters and may include only alphanumeric characters, spaces, periods, commas, underscores, and dashes.

5. The Request details page gets updated with the details.

To create a multiperson authorization policy

1. Navigate to Multiperson authorization.
2. In the Custom policies panel, click Create.
3. In the Create multiperson authorization policy window, enter the following details:

   • Policy name: Specify the policy name.

   • Expire pending requests after: Set the period (in hours) after which any pending requests will expire.

   • Send requests to: Specify a comma-separated list of email addresses for notifications.

   • Exempted accounts: Specify accounts that are exempted from multiperson authorization (if any).

     To exempt an Active Directory (AD) user, enter the user name in the format DOMAIN\username, for example FLEXAD\user. The user must be imported with the same domain-qualified user name. If the remote user domain is connected to a global catalog server, you can exempt AD users from any domain in the forest. If it is not, you can exempt only users from the configured domain.

     For more information, see Exempting an Active Directory user from multiperson authorization

   • Delete resolved requests after: Specify the period (in days) after which resolved requests will be deleted.

   • Approver role: Specify the approvers.

   • Number of approvals: Specify the number of approvals required.

   • Under Operations, select the operations that require multiperson authorization.

   • Under Behavior after approval, choose any option:

     • Automatically: The requested operation will be completed automatically after approval.

     • Manually: The requested operation will have to be completed manually after approval. Navigate to the Request management page. Select the request and click Complete operation.

4. Click Create.
5. In the confirmation pop-up, review the information and click Create.

To exempt an Active Directory user

1. Determine the short domain name. It is the first value of the Base DN of the remote user domain. For example, if the Base DN is dc=flexad,dc=local, the short domain name is FLEXAD.
2. Import the user with the short domain name prefix, for example FLEXAD\user.

   See Importing a remote user or user group to the Flex Appliance Console.

3. Add the same user name, FLEXAD\user, to the Exempted accounts list of the multiperson authorization policy.

   For more information, see Creating multiperson authorization policy

To update an existing user who must be exempted

1. Record the roles and the account settings of the user.
2. Revoke the personal API token of the user, and stop any automation that uses the token.

   See Managing personal API tokens.

3. On the Access management page, remove the imported user account, for example user.

   Caution:

   Remove only the imported account. Do not delete the user from Active Directory, and do not remove the remote user domain.

   See Removing user or service accounts from the Flex Appliance Console.

4. Import the user again with the domain-qualified user name, for example FLEXAD\user.
5. Assign the roles that you recorded in step 1, and reconfigure the account settings.
6. Add FLEXAD\user to the Exempted accounts list of the policy.
7. Generate a new personal API token, and use it for all API operations.

To delete a custom policy

1. Navigate to Settings > Security and compliance > Multiperson authorization.
2. The Multiperson authorization page lists all the custom policies.
3. You can delete the custom policy by clicking Delete on the right side of the row.
4. Provide confirmation in the pop-up.