--- title: Managerial Approval Connection Reservation slug: kronpam-reference-guide-3-8-0/managerial-approval-connection-reservation description: Learn how to make reservations for RDP, SSH, SFTP, and HTTP connections with proxy access that require managerial approval. This document explains the three types of reservations available: single devices, device groups, and remote applications. Follow th docTags: createdAt: 2022-07-27T11:15:55.000Z --- For devices that require managerial approval for RDP/SSH/SFTP/HTTP proxy connections, users can make reservations for future dates to get their approvals before the planned activity. To make a reservation for a single device, follow the steps below: - Navigate to **Devices **> **Inventory** > **Reservation **tab. ![](https://api.archbee.com/api/optimize/g9cApVza9NIhSh0pjZYtA/C6PgwmcDJEovkG8sGHuN__image.png "Connection Reservation tab") 1. Select **Target Type** as **Single Device** by clicking the **+ **button. 2. Start typing the host info in the **Host **field and select the device that appears in the search results. 3. Select a connection username if the reservation is specific to a connection username, then click the **Add** button. 4. By default, users can enter a description in the reason field; this field is optional. However, if desired, this field can be made mandatory by using the system parameter **aioc.connection.reservation.reason.required**. You can find the details of this parameter in [APPENDIX 1: System Config Manager Parameters](docId\:ii2VcTBaBmYk3ZQMwYOEL) 5. To add more devices to the reservation target list, repeat steps 2 to 4. 6. With the **Next** button, **Select Time Start** and **Time End** and click **Add Reservation**. ![](https://api.archbee.com/api/optimize/g9cApVza9NIhSh0pjZYtA/dJpCbN2L72kijCaaAyD3p_image.png "Single Device selection for Connection Reservation") You can also add a Device Group to your target selection. To add a Device Group, follow the steps below: 1. Navigate to **Devices > Inventory > Reservation** tab. 2. Select **Target Type** as **Device Group** after clicking the plus **+** button. 3. Start typing the host info in the **Host** field and select the device group that appears in the search results. 4. Select a connection username if the reservation is specific to a connection username, then click the **Add** button. 5. Optionally type a description in the reason field. 6. To add more device groups to the reservation, repeat steps 2 to 4. 7. With the **Next** button, Select **Time Start** and **Time End,** and click **Add** **Reservation**. ![](https://api.archbee.com/api/optimize/g9cApVza9NIhSh0pjZYtA/u1sJO1Lrs2vtSBf5vZcDN_image.png "Device Group selection for Connection Reservation") Instead of a Device, a Remote Application can also be added to the connection Reservation (see [Auto Login Feature for RDP Remote Applications](docId\:FEsI78lCDbqHqvG_2vmVK) for more details). To add a Remote Application, follow the steps below: 1. Navigate to **Devices > Inventory > Reservation** tab. 2. Select Remote Application as the **Reservation Type **after clicking the plus **+ **button. **Remote App Name**, **RDP Server**, **Remote App User**, and **Connection Username **fields will appear. 3. Select the name of the remote application from the **Remote App Name** combo box. 4. The RDP devices in the device groups for which the selected remote app is enabled will appear in the RDP Server combo box. 5. Select one of them, or all of them to specify on which server the Remote App connection is to be established. 6. The usernames available in the Remote Application auto-login process will appear in the Remote App User combo box. 7. Select one of them, or all of them to specify which remote app user will be used during auto login. 8. The usernames enabled for the RDP server itself will appear in the **Connection Username** combo box. Select one of them, or all of them. 9. Optionally type a description in the reason field. 10. To add more remote applications to the reservation, repeat steps 3 to 8. 11. With the **Next** button, select **Time Start** and **Time End** and click **Add Reservation.** ![](https://api.archbee.com/api/optimize/g9cApVza9NIhSh0pjZYtA/QcpYLGbPnDArXyRI7Zhjg_image.png "Remote Application selection for Connection Reservation") Any connection reservation request can include multiple Single Devices, Device Groups, and Remote Applications all at once. User group managers can make reservations on behalf of the members of their groups. To enable this ability, the **Reservation on Behalf of Group Member **function group must be added to the Portal Functions of the User Group. After adding the function group, a field called **For User** appears in the **Connection Reservation** tab when the group managers log in. After completing these steps, the reservation record will appear in the **My Approvals **list on the dashboard, and the manager responsible for approvals will receive the approval request email. Both the search results and the email include an Approval ID number. This number can be used when searching for reservations in My Approvals, Reservations, and Logging screens. If the manager approves the request, the user can connect to the device(s) with the connection username within the specified reservation times. If the manager does not approve or reject the request before the reservation end time, expired requests are indicated on the My Approvals list by showing an **Expired** status for such requests. :::hint{type="info"} When you want to start the connection reservation process via email, the manager receives an email that includes this header: \ - Connection Reservation Approval Notification - #\ ::: :::hint{type="info"} If you want to enable Expiry Notification of connection reservations, the **aioc.connection.reservation.expiration.alert.before.values **parameter should be saved as number of days on the System Config Manager. Thanks to this parameter, users can submit reservation requests again to extend the connection end time. ::: :::hint{type="info"} If the **allow\.changing.reservation.time.by.approver** system parameter set as true, the approver will be able to change the reservation time (start time and/or end time) during approval and Kron PAM will notify the requester of the time window change. ::: :::hint{type="info"} Users should configure the kill.session.on.reservation.end parameter in the System Configuration Manager screen to ensure that sessions are terminated after the specified reservation time ends. For more details about this parameter, please refer to [APPENDIX 1: System Config Manager Parameters](docId\:ii2VcTBaBmYk3ZQMwYOEL) ::: :::hint{type="info"} Users can be prevented from submitting reservation requests that exceed a certain duration (e.g., 90 hours/days) when requesting approval through the system. If the aioc.connection.reservation.max.allowed.hours is defined (e.g., 2160 hours = 90 days), users will not be able to submit reservation requests that exceed this limit. When a user enters a duration beyond the limit on the reservation screen, the following warning message will be displayed: "**Requested approval duration exceeds the allowed limit of 90 days**.” :::