--- title: Approval Workflow slug: kronpam-legacy-ui-reference-guide-3-5-0/approval-workflow description: Learn how to utilize the Managerial Approval and Approval Workflow features in Kron PAM to customize and enhance authentication and authorization processes. This document provides detailed instructions on configuring one-level or multiple-level approval m docTags: createdAt: 2022-07-27T11:29:46.000Z --- The Managerial Approval feature can also be managed by creating workflows so that the authentication and authorization processes are fully customized in terms of approval management. The Approval Workflow is available for Managerial Approval of Connections and Commands. The implementation of an approval workflow for connections and/or commands leads to a fully customized and flexible environment to manage the authentication process. These Managerial Approval features allow the configuration of a one-level approval mechanism by default, with the user group manager as the managing authority. Additional and increasing levels of managerial approval can be added, in which case, the approval authority can now be assigned for each level - the approval authority can be a user group manager, members of a user group, or any external email address or phone number, which are not required to be defined in the Kron PAM instance. The Approval Workflow feature can be managed as a policy and used in a policy realm so that the designed workflow can be applied to device realms to flexibly control each user group’s authentication and authorization processes for each device group. To configure the Approval Workflow: 1. Navigate to **Policy Control** > **Session Policy** > **Approval Workflow**. 2. Define a name for the **Approval Workflow** and click **Add Level**. ![](https://api.archbee.com/api/optimize/g9cApVza9NIhSh0pjZYtA/Eh7ZVYF5NRAXlp7qNU5P9_image.png "Approval Workflow Configurations") - Configure the level details in the **Add Level** window. Select the Authority and **Approval Tool** and click **Save**. ::Image[]{src="https://api.archbee.com/api/optimize/g9cApVza9NIhSh0pjZYtA/Mh78269s2VHuSAHpOsx7M_image.png" size="84" width="788" height="475" caption="Approval Level Configurations" position="center" showCaption="true"} - After adding one level to the workflow, you can save the workflow or add more levels by using the **Add Level** button. :::hint{type="info"} If a workflow level is deleted, the new workflow will only be used for new reservation requests. For older created requests the previously created workflow levels are used. ::: **Hints for the Approval Workflow Configuration**: **Hints for the Approval Workflow Configuration:** The **Authority** field in the Add Level window includes two options: 1. The** Escalate to Group Manager** option allows the manager of the selected group to respond to the approval request. 2. The** Escalate to Group** option allows one of the selected group members to respond to the approval request. o   *The **AD Line Manager** option allows the requester’s Active Directory manager to respond to the approval request.* o   *The Extra Notification checkbox allows information about approval notifications to be sent to the selected user groups.* o   *The Select User Group for Approver option allows you to send approval notifications to other approvers only.* o   *The Select User Group for Requester option allows you to send approval notifications to other requesters only.* - The **Select Group** field in the Add Level window is a combo box that defines which User Group’s Manager or members will be selected as the approving authority. - The **Approval Tool** field in the Add Level window includes two checkboxes: **Email** and **SMS** - these are the mediums for sending the approval request to the approving authority. - The **Timeout Period** field in the Add Level window is a combo box where you can select the timeout period to start an escalation. Default values are 30 minutes, 2 hours, and 24 hours. You can change the values in the combo box with the **approval.workflow\.level.timeout.period.values** parameter in the System Config. Man. The request gets escalated to the Escalation Authority after the specified period. If nothing is selected, no escalation is done.      - The** Escalation Authority** field in the “Add Level window selects the authority to whom the request will be escalated after the **Timeout Period**. The selection mechanism is similar to the **Authority **field.    - The **Escalation Group** field in the Add Level window defines which User Group’s Manager or members will be selected for the approval escalation. - The **Options **button in the Workflow Level settings panel controls the level order and includes two options: Up-Level and Down-Level. ### Connection Approval Workflow The Approval Workflow feature can be used to manage user authentication to devices by using the defined approval workflow as a policy. This is only applicable to RDP/SSH/SFTP/HTTP Proxy sessions. To use the designed workflow during user connection to some devices: 1. Navigate to **Policy Control** > **Session Policy **> **Policy Group**. 2. In the **Action** combo box on the right side of the page, select **Approval via Email**. 3. Select the desired workflow from the **Workflow for Connection Approval** list, which will be enabled after selecting **Approval via Email**. ![](https://api.archbee.com/api/optimize/g9cApVza9NIhSh0pjZYtA/BzMmyh-QzNzXgQtgMsC6G_image.png "Connection Approval Workflow Configuration") ### Command Approval Workflow The Approval Workflow feature can be used to manage authorization in devices by using the defined approval workflow as a policy, which means some commands will need approval(s) to be run during the session. To use the designed workflow to configure user authorization: 1. Navigate to **Policy Control **> **Session Policy** > **Policy Group**. 2. Add the commands that can be run, if approved by the designated authority 3. In the** Action** combo box on the right side of the page, select **Approval via Email**. 4. Select the desired workflow from the** Workflow for Command Approval** list, which will be enabled after selecting** Approval via Email**. ![](https://api.archbee.com/api/optimize/g9cApVza9NIhSh0pjZYtA/3_E16oFSmbRyiMNK8OV4I_image.png "Command Approval Workflow Configuration")