---
title: Password Retrieval Approval Notifications
slug: kronpam-reference-guide-3-9-0/password-retrieval-approval-notifications
description: Learn how to set up an approval requirement mechanism for password retrieval in this detailed document. Follow the steps to navigate to the Policy Control > Portal Functions section and select the SAPM Approval Requirement Function Group and User Group. T
docTags: 
createdAt: 2022-07-29T13:44:51.000Z
---

An approval requirement mechanism for password retrieval can be established for user groups that share a device group realm with the device that contains the Vault account.
To set up an approval requirement for a user group:

1. Navigate to **Policy > Portal Functions.**
2. Open the **Realm Definition** tab.
3. Click the **Add** button.
4. Select the **SAPM Approval Requirement Function Group** and the** User Group **(The **SAPM Management **function group still needs to be included in the realm, to allow the users to see the Vault Management portal)
5. Click **Save.**

::Image[]{src="https://api.archbee.com/api/optimize/g9cApVza9NIhSh0pjZYtA/X54D9B08a-cgaHFwtYuYq_image.png" size="66" width="980" height="650" position="center" caption="Portal Functions Realm or a Password Vault Approval Requirement Group " showCaption="true"}

When a user requests the Account password and needs administrative approval, a** Password Vault Approval Request** email is sent to the following users:

- Members of the user groups with FULL\_CONTROL permission over the Vault account for which the approval request was sent.
- Members of the user groups with the portal function **single.connect.sapm.admin** or **single.connect.sapm.network.admin **(or the Password Vault Admin or Password Vault Network Admin function groups)

| single.connect**.sapm.admin**    | Grants rights to manage all Vault accounts and view all logs.                     |
| ------------------------------------- | --------------------------------------------------------------------------------- |
| single.connect.**sapm.network.admin** | Grants rights to manage and view all accounts of the devices defined to the user. |

The approval email sent to the above users contains:

- Vault Account Name 
- Vault Group Full Path 
- Approval Level 
- Permission information from the email content below. 

![](https://api.archbee.com/api/optimize/g9cApVza9NIhSh0pjZYtA/6o8I_qZGa2h4ohokERvEP_image.png "Vault Approval Request -mail")