PIM Manager settings · Settings > Access requests
API applications (client ids)
| Key | RfaBroker.ApiAppIds |
|---|---|
| Where | Settings > Access requests (RFA) > RFA broker & API |
| Type | List |
| Default | Empty (no application may call the API) |
| Feature | Access request portal: switch on an account, or get temporary group access · Pro Business, Pro Enterprise, Pro MSP |
| Confirmation | PIM Manager asks you to confirm before it is switched on. |
What it does
The Entra application (client) ids allowed to call the access request REST API, typically your ticketing system. The engine publishes the list to the portal for a fast answer and re-checks every API request itself.
When set
When set: a listed application can request, through the API, that an admin account is enabled for 1-744 hours or that an account gets a timed group membership. API requests are approved on arrival -- no department owner decision -- and the engine applies them on its next run, within a few minutes; a group request is limited to the groups offered (and to the groups set for that key or application), and a Tier 0 or Tier 1 group, or a group with no tier set, waits for a person to approve it. It can also send proposals, which only become pending changes for an administrator.
When blank or default
When empty / at the default: every API call made with an Entra application token is refused. API keys still work if you create them.
Risk and how to reverse it
Each listed application can grant timed privileged access without a second person in PIM Manager, so the approval must happen in that system. API group requests are held to the groups offered for ad-hoc access, and each application can be limited to its own groups (Groups each application may request). Reversible: remove the id; the engine refuses its new requests on the next run, but access already granted runs until its end time.
Requires
Pro (Request for authorization portal and the access request API). SuperAdmin to change. Values must be application (client) ids (GUIDs).
Recommended
List only the one application of your ticketing system, and make sure its own workflow requires approval before it calls the API.
Related settings
- Request for authorization (RFA) portal FeatureGates.rfa.portal
- Access request API (REST, for ServiceNow and other systems) FeatureGates.api.broker
- Company name PortalBranding.CompanyName
- Support e-mail PortalBranding.SupportEmail
- RFA store account RfaBroker.StoreAccount
- Public portal URL RfaBroker.PortalUrl
- Ad-hoc groups consultants may request RfaBroker.AdHocGroups
- Default ad-hoc length (hours) RfaBroker.AdHocHours
- API keys RfaApiKeys
Documented for PIM Manager 3.0.70. Written by the PIM Manager team; Invardia publishes it. · All settings · Security review pack