Access Duration refers to the amount of time access will be open to requestors.

By enabling this feature, admins require requestors to specify the access time they will need out of the maximum allowed.

This enhances security and accountability by requiring users to specify the length of access needed for each request.

When a user submits a request, the approver sees the requested duration along with other request details. Upon approval, the user is granted access for the specified period.

Enable the Access Duration setting

By default, access duration is disabled. We recommend enabling this setting to keep open access down to the minimum amount of time needed for a specific task.

Follow this step to enable access duration:

1. On the Settings page, click the Require duration for access request toggle to on. The toggle will turn green.

Once the setting has been enabled, users must specify their access duration, up to the maximum access duration set by the admin. If the requested duration exceeds the limit, an error message will appear. Entering zero or an invalid value prompts the user to reenter a valid duration.

Pick the duration in an access request

Once enabled, users requesting access will be asked to enter their desired access duration when making requests.

Self serve access flows grant access to a resource based on a user request for a defined time period.

This access flow type is best used for sensitive or highly regulated resources, such as access to production. It also suits just-in-time (JIT) or break-glass access cases.

To create a self serve access flow, you must define the permitted requestors, available resources, and approvers.

Prerequisites

Define permitted requestors

Follow these steps to define the permitted requestors:

1. On the Access Flows page, click Create Access Flow. The Create Access Flow page appears.

2. (Optional) Configure Settings.

3. Click Self Serve. The Self Serve fields appear below.

4. Enter an alphanumeric, user-friendly Access Flow Name.

5. Click When. A settings window appears to set the access period.

6. Set the access period.\
7. Click Select attribute to select an IdP attribute, such as User or Group.

8. (Optional) Click is to select conditional logic from the menu options.

1. Click Select value to select one or multiple users or groups from the menu options. This selection determines who is permitted to request access.

2. (Optional) Add another condition.

   1. Under the last listed requestor, click +. A new row appears.

   2. Repeat steps 7-10.

   3. Select the conditional logic for the multiple requestors.\

Define the resource

Integrations

You can define access to specific resources in an Apono integration.

Follow these step to define access to specific resources:

1. Under They will have access to, click Select target > Integrations.

2. Select an integration. The Select resource type panel appears.

3. Select the resource type.

4. Click Done. The panel closes.

5. Click permissions. The Permissions menu appears.

6. Select one or more permissions to grant the requester.

7. (Optional) Refine the available resources:

   1. Click in the populated to field. A list of resources appears.

   2. Select one or several resources.

1. (Optional) Add another target:

   1. Click + at the end of the row. A new target row appears.

   2. Repeat steps 1-7.

Bundles

You can define access to a specific bundle.

Follow these steps to define access to a specific bundle:

1. Click Select target > Bundles.

2. Select a bundle.

3. (Optional) To add another bundle, click +. A new target row appears.

4. Repeat steps 1-2.

Set access duration and approval process

Follow these steps to define the duration of access:

1. Click in the populated Grant for field. The granting period settings appear.\
2. Click Automatic to select the approval type.\
3. Click Create Access Flow.

Set up custom approval

Approval of provides in-depth options to customize the approval flow. This approval type is ideal for production environments and highly sensitive resources.

Follow these steps to set up Approval of:

1. Click the populated with field. The approval type menu appears.

2. Click Approval of. The Approval of fields appear.

3. Click Select attribute to select an IdP attribute, such as User, Group, or Owner.

1. (Optional) Click is to select conditional logic from the menu options.

1. Click Select value to select one or multiple users or groups from the menu options. This selection determines who is permitted to approve access.

2. (Optional) Add another approver condition.

   1. Immediately beneath the last list approver, click +. A new row appears.

   2. Repeat steps 3-5 to add another approver to the group.

   3. Select the conditional logic for the multiple approvers.\
3. (Optional) Add another approver group.

   1. Beneath the last approver group, click +. A new approval group appears.

   2. Repeat steps 3-6 to add another approver to the group.

   3. Select the conditional logic for the multiple groups of approvers.\

Apono allows administrators to apply various settings to enhance the security of Access Flows.

Admin settings offer several advantages:

• Organize Access Flows for efficient use and discovery

• Require justification for access requests

• Prevent self-approval when a requester is also part of the approval process

Apply Admin Settings

Follow these steps to apply admin settings:

1. On the Create Access Flows page, click Settings. The Settings panel opens.

2. Enable one or more admin settings.\
3. Click the X to close the panel.

4. For an existing access flow, click Save Access Flow. Otherwise, continue creating the new self serve or automatic access flow.

To create an automatic access flow, you must define the permitted users and available resources.

Prerequisites

Define permitted users

Follow these steps to define the permitted requestors:

3. Click Automatic. The Automatic fields appear below.

4. Enter an alphanumeric, user-friendly Access Flow Name.

5. Click Select attribute to select an IdP attribute, such as User or Group.

6. (Optional) Click is to select conditional logic from the menu options.

1. Click Select value to select one or multiple users or groups from the menu options. This selection determines who is permitted to request access.

2. (Optional) Add another user.

   1. Under the last listed requestor, click +. A new row appears.

   2. Repeat steps 5-8.

   3. Select the conditional logic for the multiple requestors.\

Define the resource

Integrations

You can define access to specific resources in an Apono integration.

Follow these step to define access to specific resources:

1. Under Request access to, click Select target > Integrations.

2. Select an integration. The Select resource type panel appears.

3. Click Done. The panel closes.

4. Click permissions. The Permissions menu appears.

5. Select one or more permissions to grant the requester.

6. (Optional) Refine the available resources:

   1. Click in the populated to field. A list of resources appears.

   2. Select one or several resources.

1. (Optional) Add another target:

   1. Click + at the end of the row. A new target row appears.

   2. Repeat steps 1-7.

Bundles

You can define access to a specific bundle.

Follow these steps to define access to a specific bundle:

1. Click Select target > Bundles.

2. Select a bundle.

3. (Optional) To add another bundle, click +. A new target row appears.

4. Repeat steps 1-2.

Review the access flow

1. Click Review and Create. The Automatic Access Flow Summary appears.

1. Click Create and Grant.