Manage approval requests in Azure Enclave

This article explains how to review, approve, and reject approval requests in Azure Enclave. Users with the Enclave Approver Role can manage approval requests to ensure proper oversight of critical infrastructure changes.

Important

The Approvals feature is currently in Preview. This feature is encouraged for testing but shouldn't be used for production workloads while in preview.

Prerequisites

To manage approval requests, you need:

• The Enclave Approver Role assigned at the enclave or community level
• Access to the Azure portal or Azure CLI
• Permissions to view the resources related to the approval request

View pending approval requests

1. Sign in to the Azure portal.

2. Navigate to your Azure Enclave enclave or community resource.

3. In the left navigation menu, select Approvals.

4. The Approvals page displays all pending, approved, and rejected requests.

5. Use the filters to view specific types of requests:

   • Approval status: Pending, Approved, Rejected
   • Requester: Filter by who submitted the request
   • Requested on: Filter by submission date/time range
   • Parent Resource: Filter to the enclave or community of interest
   • Action Type (if shown in your portal experience): Filter by the requested operation

Review an approval request

Before approving or rejecting a request, carefully review the details:

1. In the Approvals list, select the checkbox for the request you want to review, and select Review.

2. The approval details page displays:

   • Resource: The requested resource
   • Enclave or Community: Links to the parent resources associated with the request
   • Requester: The user who submitted the request
   • Request date: When the request was submitted
   • Ticket Id: An optional field for you to link to your change tracking system
   • Approvals: Allows you to approve or reject this request
   • Approval status: The status of meeting the approval requirements.
   • Approver details: The list of who approved or rejected the request.

3. Review all information carefully before making a decision.

Approve a request

After reviewing a request, approve it to allow the change to proceed:

1. On the approval details page, select Approve.

2. Select Submit to approve the request.

3. The request status is now Approved and the resource change is automatically implemented.

Reject a request

If a request doesn't meet approval criteria, reject it:

1. On the approval details page, select Reject.

2. Select Submit to reject the request.

3. The request status changes to Rejected and the resource change won't be implemented.

Common approval scenarios

Approving enclave creation

When reviewing an enclave creation request:

1. Validate purpose and ownership: Confirm the enclave has a clear business purpose and accountable owners
2. Check placement and scope: Verify the enclave is being created in the correct community and scope
3. Review baseline security expectations: Ensure required governance and security controls are planned
4. Confirm naming and lifecycle standards: Validate alignment with naming, tagging, and lifecycle requirements

Example approval: "Approved. New enclave supports the approved workload onboarding plan and meets ownership and governance requirements."

Example rejection: "Rejected. Enclave purpose and ownership are incomplete. Provide accountable owners and updated deployment justification before resubmitting."

Approving a maintenance mode change

When reviewing a maintenance mode request:

1. Verify maintenance window: Confirm the change aligns to an approved maintenance window
2. Validate impact communication: Ensure affected stakeholders are informed
3. Check rollback/readiness plans: Confirm there's a clear rollback or completion plan
4. Assess operational risk: Review service and dependency effect before approval

Example approval: "Approved. Maintenance mode is scheduled in the approved change window with a documented rollback plan."

Example rejection: "Rejected. Maintenance window and service effect plan are missing. Add operational readiness details and resubmit."

Approving an enclave connection

When reviewing an enclave connection request:

1. Verify the source and destination: Ensure the connection is between authorized enclaves or external endpoints
2. Check network rules: Review the firewall rules and network security group configurations
3. Validate business justification: Confirm there's a legitimate business need for the connection
4. Assess security implications: Evaluate whether the connection poses any security risks
5. Review compliance requirements: Ensure the connection meets organizational compliance standards

Example approval: "Approved. Connection between production and logging enclave is necessary for centralized log aggregation. Security team verified firewall rules."

Example rejection: "Rejected. Connection to external endpoint requires more security review. Submit a detailed security assessment and obtain InfoSec approval before resubmitting."

Approving an enclave endpoint

When reviewing an enclave endpoint request:

1. Review endpoint rules: Check the network rules being added or modified
2. Verify allowed/denied traffic: Ensure the endpoint controls align with security policies
3. Check for overly permissive rules: Look for rules that might grant excessive access
4. Validate compliance: Confirm the endpoint configuration meets compliance requirements

Example approval: "Approved. Endpoint configuration follows least-privilege principles and the network security team reviewed this request."

Example rejection: "Rejected. Endpoint allows traffic from 0.0.0.0/0, which violates security policy. Restrict to specific IP ranges and resubmit."

Approving a community endpoint

When reviewing a community endpoint request:

1. Assess external connectivity: Verify the external destination is trusted and necessary
2. Review transit hub configuration: If VPN or ExpressRoute is involved, ensure proper configuration
3. Check firewall rules: Verify Azure Firewall rules are appropriately restrictive
4. Validate third-party access: If allowing access to/from external parties, ensure proper authorization

Example approval: "Approved. VPN connection to partner network is required for data exchange as specified in the partnership agreement. Connection is properly secured with IPsec."

Example rejection: "Rejected. External connection requires approval from the Chief Information Security Officer (CISO). Obtain written approval and attach to the request."

Bulk approval operations

The Approvals page currently supports acting on one request at a time. Select a single request and use Approve or Reject on its approval details page. There's no multi-select bulk approve or reject option in this experience.

View approval history

Approved and rejected requests remain visible in the same Approvals list alongside pending requests:

1. Navigate to your enclave or community resource.

2. Select Approvals in the left navigation menu.

3. Filter the list by:

   • Approval status: View only approved or rejected requests.
   • Requested on: View approvals within a specific timeframe.
   • Requester: See requests submitted by specific users.
   • Action Type: Filter by resource type or operation.

4. Select any historical request to view its full details.

Notification behavior

The Approvals feature doesn't currently provide a built-in email notification option for approval requests.

Use your organization's monitoring and operational processes to track and triage pending approvals.

Best practices for approval management

When managing approval requests:

1. Review promptly: Respond to approval requests in a timely manner to avoid blocking legitimate operations

2. Provide clear feedback: When rejecting requests, explain the reason and provide guidance for resubmission

3. Document decisions: Add comments to approvals explaining the reasoning, especially for complex decisions

4. Use consistent criteria: Apply the same approval standards across similar requests to ensure fairness

5. Escalate when needed: If uncertain about a request, escalate to senior leadership or security teams

6. Regular audits: Periodically review approval history to identify patterns or potential issues

7. Update policies: Based on approval patterns, update governance policies to improve the process

8. Communicate with requesters: For complex requests, consider discussing with the requester before making a decision

Delegate approval authority

In some cases, you might need to temporarily delegate approval authority:

1. Navigate to Access control (IAM) for the enclave or community.

2. Assign the Enclave Approver Role to the delegate.

3. Set an expiration date for temporary delegations.

4. For permanent delegation, consider using Azure PIM with appropriate approval workflows.

Learn more about role assignments

Troubleshooting

Can't see pending approval requests

Cause: You don't have the Enclave Approver Role or the role is assigned at the wrong scope.

Solution: Verify with your administrator that you have the Enclave Approver Role assigned at the appropriate level (enclave or community).

Approved request isn't being implemented

Cause: The resource might have conflicts or insufficient permissions to complete the deployment.

Solution: Check Azure Activity Logs for errors. Ensure the system has the necessary permissions to implement the approved change.

Unable to approve or reject

Cause: Check if another approver processed the request already or if there's a permission issue.

Solution: Refresh the page to see the current status. If the issue persists, verify your role assignment.

Next steps

• Configure Approvals
• Learn about the Approvals feature
• Understand Azure Enclave RBAC
• Configure Just-in-Time Access
• Create an enclave connection