PIM Manager settings · Settings > Features & edition
Approval-gated offboarding + revoke (preview)
| Key | GovernancePreview.approvalsPreview |
|---|---|
| Where | Settings > Features & edition > Governance preview |
| Type | On / off |
| Default | Off |
| Feature | A second administrator for sensitive changes · Pro Business, Pro Enterprise, Pro MSP |
| Confirmation | PIM Manager asks you to confirm before it is switched on. |
What it does
Turns on the action paths of the Approvals page: raising an approval request, deciding it, and running an approved offboarding. When off, the page can be viewed, but PIM Manager refuses those actions. PIM Manager reads the switch on every request, so it applies at once. The page banner updates on the next reload.
When enabled
An administrator can raise an offboarding or revoke request with a justification. A different administrator approves it, and running it stages the disable and revoke, which the engine applies on its next run (the account is disabled, never deleted). Requests from 'Second-approver on sensitive changes' can be raised and decided too.
When disabled
Raising, deciding and running approvals are refused. An edit that would disable an admin now (a past disable date, or status Disabled/Removed) is not saved, so you cannot offboard an admin through PIM Manager. Sensitive commits that need a second approver cannot be approved.
Risk and how to reverse it
Switching it on makes approved offboarding possible, which removes admins' access. The always-on guards stay in force either way: the account-disable circuit breaker, break-glass protection, and offboarding never running automatically. Reversible: switch it off and actions are refused at once. Offboardings already applied are not undone.
Requires
Free (Community) and Pro. SuperAdmin to change it. At least two administrators, unless self-approval is enabled under Settings > Approvals & policy. Needed by 'Second-approver on sensitive changes'.
Recommended
On once you have two administrators and want offboarding to go through PIM Manager with a second person's approval.
Related settings
- Second-approver on sensitive changes FeatureGates.makerchecker
- Approvals FeatureFlags.approvals
- Allow an administrator to approve their own requests ApprovalSelfApprove
- Second approver PendingSecondApprover
- An approval request expires after (hours) ApprovalRequestTtlHours
Documented for PIM Manager 3.0.70. Written by the PIM Manager team; Invardia publishes it. · All settings · Security review pack