--- title: Managerial Approval for Connections slug: kronpam-reference-guide-3-9-0/managerial-approval-for-connections description: Learn how to use the Connection Approval feature to manage user authentications for device connections. Set up an approval process for users to require managerial approval before connecting devices. Configure approval settings for user groups and device g docTags: createdAt: 2022-07-27T11:12:29.000Z --- Kron PAM supports Just-In-Time (JIT) privileged access through managerial approval and connection reservation workflows for SSH, RDP, SFTP and HTTPS connections. Privileged access can be granted temporarily for a specific work requirement and for a defined period. Once the approved access period expires, the temporary privilege is automatically revoked, supporting a Zero Standing Privileges (ZSP) security model and minimizing persistent privileged access. Admins can configure an approval process so that users will require managerial approval to connect devices. Connection approvals may be given by managers or members of user groups. To disable instant approval connections and use only connection reservation, the following parameters need to be set to **true **on System Config Manager. Their default value is false. disable.instant.approval.for.ssh disable.instant.approval.for.rdp disable.instant.approval.for.sftp disable.instant.approval.for.http Refer to the [APPENDIX 1: System Config Manager Parameters](docId:8bUGsVIVssaqmM5a_j8dX) :::hint{type="info"} If you want to set up an approval process to manage connections of a specific user group to a specific device group, you should configure an **Approval Workflow. **Refer to the [Approval Workflow](docId\:Noigy0UuWfaKXSpvdub3c) section for details. ::: :::hint{type="info"} If the requester is also the manager of the group and **auto.approve.when.requester.is.approver** is set as** true**, approval will be given automatically and the connection will be established. Thus, the manager does not need to actively approve. **aioc.approval.excludeRequester.enabled=true** does the opposite, and blocks the managers from approving their own requests, requiring approval from another manager. ::: :::hint{type="info"} When you want to approve or reject connections via email, the manager receives an email including the header as this: \ - Connection Approval Notification - \#\ ::: ![](https://app.archbee.com/api/optimize/g9cApVza9NIhSh0pjZYtA/YvyOMzPrVLQIkgtQJkJSi_image.png "My Approvals screen") :::hint{type="info"} My Approvals list shows request details and the Approver Manager, which helps involved parties know who will be approving the request. With the advanced filtering feature, incoming connection and command requests can be searched based on specific criteria and easily viewed. ::: :::hint{type="info"} If the manager does not approve or reject connection requests and **approval.status.change.to.expire** is in effect (value in minutes), the request status changes from **Waiting **to **Expired **on my Approvals Page. ::: :::hint{type="info"} If no active approver is available in an approver user group associated with any approval step in the **Approval Workflow**, the system does not allow a **connection reservation** or **ad-hoc approval** request to be created. Before creating the request, the system validates the Approval Workflow, its approval steps, and the associated approver user groups. If no active approver is found, the following warning message is displayed: ***“No active approver is defined in the approver user group associated with the approval workflow.*** ***Please update the approval workflow configuration”*** :::