manager approval

Question

We are sending emails that have sensitive information to managers for approval. How do we as admins manage this when 

a.manager if out of office? Can we release the email? 

b.can we increase the days the manger has to approve the message? 

c. Also, what is the best way to troubleshoot custom sensitive types?

Thanks,

Chandrika

Answer 1

Hi Chandrika,

Thanks for your reply. For your new concerns:

1. Can we increase the days the manger has to approve the message?

Sorry for the misunderstand before. You can change the message approval expiration days via Windows PowerShell, please kindly check the steps below:

a. Connect to Exchange Online PowerShell.

b. Run Get-RetentionPolicyTag ModeratedRecipients | fl AgeLimitForRetention. Then you will see it shows as 2 days.

c. Run Set-RetentionPolicyTag ModeratedRecipients -AgeLimitForRetention 5.00:00:00 (your preferred date).

2. What is the best way to troubleshoot custom sensitive types?

If assign some users full access permission is not feasible, could you provide us more details about how you set up the managers' approval? If you set up approval via DLP policy, you can choose multiple people to be approvers. Anyone who is in this range can approve or reject the sensitive message. When one of them approves, the others will not receive the email repeatedly. You can refer the screenshot below:

I hope that might help you. If you have any further concerns, please feel free to let us know.

Best Regards,

Sylvie

Answer 2

Hi Chandrika,

Sorry for the delay reply.

If you do not want to change mail flow rules when folks leave or change their role, you can try creating a shared mailbox in the Exchange admin centerand assign full permission to the approvers you want. Then set the rule up to send the email to the shared mailbox. Anyone who has full permission of this shared mailbox is able to approve or reject the sensitive message. When one of them approved or reject, others don’t have to do it again. As you said, when the folks leave or change their roles, just remove their permission from shared mailbox and you don’t have to change the rules.

If you still have questions about it, please don’t hesitate to contact us.

Best Regards,

Sylvie

Answer 3

Hi Chandrika,

Thanks for your reply. For your new concerns:

1. Can we increase the days the manger has to approve the message?

Sorry for the misunderstand before. You can change the message approval expiration days via Windows PowerShell, please kindly check the steps below:

a. Connect to Exchange Online PowerShell.

b. Run Get-RetentionPolicyTag ModeratedRecipients | fl AgeLimitForRetention. Then you will see it shows as 2 days.

c. Run Set-RetentionPolicyTag ModeratedRecipients -AgeLimitForRetention 5.00:00:00 (your preferred date).

This is helpful - thank you.

2. What is the best way to troubleshoot custom sensitive types?

If assign some users full access permission is not feasible, could you provide us more details about how you set up the managers' approval? If you set up approval via DLP policy, you can choose multiple people to be approvers. Anyone who is in this range can approve or reject the sensitive message. When one of them approves, the others will not receive the email repeatedly. You can refer the screenshot below:

I hope that might help you. If you have any further concerns, please feel free to let us know.

We are using the mail flow rules for dlp. We could go down this path, but this approach does not allow us to set the rule up to send the email to the manager and another named individual as backup. We would, if at all possible not have to change mail flow rules when folks leave or change their role.

Best Regards,

Sylvie

Answer 4

Hi Chandrika,

For your concerns:

1. Can we release the email?

Generally, when you send an email and need managers' approval, your managers need to click the Approve to make the message go pass. From your side, you cannot release the email.

2. Can we increase the days the manger has to approve the message?

Based on my experience, there is no limit-day that need to approve an message. Manager can approve the message whenever. May I know how you set up the managers' approval?

The current limit is 2 days, so if an employee sends and email out of Friday, by Monday the message has expired. We need a way to update this setting, if possible.

3. What is the best way to troubleshoot custom sensitive types?

From your description, the messages contain sensitive information will be sent to managers for approval, aiming to confirm that there is no sensitive information in the emails sent out. Based on your situation, if your managers are OOF and cannot approve your messages, as a workaround, managers can assign some users full access permission so that they can access their mailboxes to approve the message. When sender gets the bounced OOF message from managers, the sender can contact the user who has full access permission of managers' mailbox to approve messages.

In some situations this may not be feasible, are there any alternate approvers we can assign?

For your reference: Give mailbox permissions to another user in Office 365 - Admin Help

Thanks,

Iry

Answer 5

Hi Chandrika,

For your concerns:

1. Can we release the email?

Generally, when you send an email and need managers' approval, your managers need to click the Approve to make the message go pass. From your side, you cannot release the email.

2. Can we increase the days the manger has to approve the message?

Based on my experience, there is no limit-day that need to approve an message. Manager can approve the message whenever. May I know how you set up the managers' approval?

3. What is the best way to troubleshoot custom sensitive types?

From your description, the messages contain sensitive information will be sent to managers for approval, aiming to confirm that there is no sensitive information in the emails sent out. Based on your situation, if your managers are OOF and cannot approve your messages, as a workaround, managers can assign some users full access permission so that they can access their mailboxes to approve the message. When sender gets the bounced OOF message from managers, the sender can contact the user who has full access permission of managers' mailbox to approve messages.

For your reference: Give mailbox permissions to another user in Office 365 - Admin Help

Thanks,

Iry