PIM Manager settings · Pending changes > Review & commit queue
Second approver
| Key | PendingSecondApprover |
|---|---|
| Where | Pending changes > Review & commit queue |
| Type | Choice |
| Default | Off |
| Feature | A second administrator for sensitive changes · Pro Business, Pro Enterprise, Pro MSP |
| Confirmation | PIM Manager asks you to confirm before it is switched off. |
What it does
Whether a change must be committed by a different administrator than the one who staged it. Off: anyone may commit what they staged. Sensitive: changes classed as sensitive (a privileged role or scope added to a group, a guest put into a privileged group, a disable or offboarding) need a second person. All: every change does.
When set
When set to Sensitive or All: a commit that carries out a change you staged yourself -- or, under All, any direct edit you make -- is refused with 'a second administrator must commit this', and the refusal is audited. Another administrator opens the shared queue and commits it. Applies from the next commit.
When blank or default
When Off (the default): the person who staged a change may commit it. Rows staged by a colleague stay locked to them in every mode.
Risk and how to reverse it
With only one administrator, Sensitive or All blocks that person's own commits. Note that a SuperAdmin can switch the mode back to Off alone. Turning it Off removes the four-eyes check on your configuration. Reversible at any time.
Requires
SuperAdmin to change it. Free (Community) and Pro. Needs at least two people with the Admin or SuperAdmin role.
Recommended
Sensitive, when you have two or more administrators: privileged changes get a second pair of eyes without slowing everyday edits.
Related settings
- Second-approver on sensitive changes FeatureGates.makerchecker
- Approval-gated offboarding + revoke (preview) GovernancePreview.approvalsPreview
- Approvals FeatureFlags.approvals
- Allow an administrator to approve their own requests ApprovalSelfApprove
- An approval request expires after (hours) ApprovalRequestTtlHours
Documented for PIM Manager 3.0.70. Written by the PIM Manager team; Invardia publishes it. · All settings · Security review pack