PIM Manager settings · Settings > Features & edition
Second-approver on sensitive changes
| Key | FeatureGates.makerchecker |
|---|---|
| Where | Settings > Features & edition > Feature customization |
| Type | On / off |
| Default | Off |
| Feature | A second administrator for sensitive changes · Pro Business, Pro Enterprise, Pro MSP |
| Confirmation | PIM Manager asks you to confirm before it is switched off. |
What it does
Requires a second administrator to approve any Review & Save commit or row deletion that touches privileged access before PIM Manager writes it. The check runs in PIM Manager at the moment you commit; it applies from the next commit after you save.
When enabled
A commit that PIM Manager classifies as sensitive is refused until a different administrator has approved it on the Approvals page. You cannot approve your own change unless self-approval is switched on (Settings > Approvals & policy). Changes that are not sensitive commit as before.
When disabled
Sensitive changes commit straight away. They are still classified as sensitive, validated and written to the audit trail, but nobody else has to approve them.
Risk and how to reverse it
With only one administrator, switching it on means no privileged change can be committed at all. Approval requests are raised on the Approvals page, and that page only takes action when 'Approval-gated offboarding + revoke (preview)' is on. If it is off, sensitive commits are blocked and cannot be approved. Being a Pro feature, it also stops applying if the Pro licence lapses. Reversible: switch it off and the next commit goes through.
Requires
A Pro licence that covers this tenant (switching it on without one is refused). SuperAdmin to change it. At least two administrators with the Admin role, and 'Approval-gated offboarding + revoke (preview)' switched on under Governance preview so approvals can be raised and decided.
Recommended
Turn it on when at least two people administer PIM Manager and you want separation of duties. Leave it off for a single-administrator tenant.
Related settings
- Approval-gated offboarding + revoke (preview) GovernancePreview.approvalsPreview
- Approvals FeatureFlags.approvals
- Allow an administrator to approve their own requests ApprovalSelfApprove
- Second approver PendingSecondApprover
- An approval request expires after (hours) ApprovalRequestTtlHours
Documented for PIM Manager 3.0.70. Written by the PIM Manager team; Invardia publishes it. · All settings · Security review pack