Put approvals where they matter.
Six steps to stand up access governance for the systems and people that need it. Each step links to the full guide in the docs.
Step 1: Bring in your workforce data
Connect a directory source (Microsoft Entra ID, Google Workspace, LDAP, or SCIM) so users, managers, and groups stay current as people join, move, and leave.
Read the guide for bring in your workforce data (opens in a new window)Step 2: Catalog your sensitive applications
Register the apps that carry real risk, such as payroll, customer data, and production access, with explicit role definitions.
Read the guide for catalog your sensitive applications (opens in a new window)Step 3: Decide who can request what
For each application, choose which roles can be requested, which approval workflow applies, how long a grant lasts, and whether a justification is required.
Read the guide for decide who can request what (opens in a new window)Step 4: Build an approval workflow
Multi-step flows with manager approval, security review, and time-limited grants. Add conditions to skip steps for low-risk requests, and webhook steps to keep ServiceNow or Jira in sync.
Read the guide for build an approval workflow (opens in a new window)Step 5: Connect partner systems
Issue scoped API keys so ServiceNow, Workday, or your HR platform can start workflows directly for joiners, movers, leavers, and time-bound access.
Read the guide for connect partner systems (opens in a new window)Step 6: Stream security events to your SIEM
Send role grants and revocations, failed sign-ins, lockouts, and session revocations to Splunk HEC, a syslog collector as CEF, Amazon SNS, or an HTTPS webhook.
Read the guide for stream security events to your siem (opens in a new window)
Setting up sign-on first?
Governance runs on Identity Platform. If you only need single sign-on today, start there.