PIM Manager settings · Settings > Access requests
RFA store account
| Key | RfaBroker.StoreAccount |
|---|---|
| Where | Settings > Access requests (RFA) > RFA broker & API |
| Type | Text |
| Default | Blank until the request portal is deployed (the deploy script fills it in) |
| Feature | Access request portal: switch on an account, or get temporary group access · Pro Business, Pro Enterprise, Pro MSP |
| Confirmation | PIM Manager asks you to confirm before it is switched on or off. |
What it does
The Azure storage account shared by the public request portal and the engine. The portal writes requests there; the engine pulls them every minute with its managed identity, re-decides each one, and writes back status, the eligibility list and the API settings. The public side never reaches PIM directly.
When set
When set: the request-portal sync runs every minute against this account -- taking in portal and API requests, enabling accounts and ad-hoc memberships, ending them when time is up, and sending the mails.
When blank or default
When blank / at the default: the request-portal sync takes in no requests and the portal is shown as not deployed -- but an access window that is still open is closed when it ends (the account is disabled again). IT overrides in the Manager still work.
Risk and how to reverse it
Blank or a wrong account stops new requests and the portal updates (the sync job reports it as failed), but the step that DISABLES accounts and removes ad-hoc memberships when their window ends keeps running -- access never stays on past its window. Pointing it at another store makes the engine act on that store's requests. Reversible: set the right account back; the next run catches up.
Requires
Pro (Request for authorization portal). The engine's managed identity needs Storage Table Data Contributor on the account (granted by the portal deploy). SuperAdmin to change. 3-24 lower-case letters and digits.
Recommended
Leave the value the portal deploy wrote; change it only when you redeploy the portal to a new storage account.
Related settings
- Request for authorization (RFA) portal FeatureGates.rfa.portal
- Access request API (REST, for ServiceNow and other systems) FeatureGates.api.broker
- Company name PortalBranding.CompanyName
- Support e-mail PortalBranding.SupportEmail
- Public portal URL RfaBroker.PortalUrl
- API applications (client ids) RfaBroker.ApiAppIds
- Ad-hoc groups consultants may request RfaBroker.AdHocGroups
- Default ad-hoc length (hours) RfaBroker.AdHocHours
- API keys RfaApiKeys
Documented for PIM Manager 3.0.70. Written by the PIM Manager team; Invardia publishes it. · All settings · Security review pack