How to Automate App and Access Approval During Onboarding

This article explains how to combine two workflows to automate app access approval during onboarding — creating a task for each requested app, routing approval to the employee's manager, and closing each task once the app owner confirms access is granted.

Applicable Plans: Available on all plans.

Prerequisites

• A form set up to capture the app owner's confirmation and the access details they grant. It can have the following fields
  • Apps - Dropdown of all the apps as values
  • Decision - Dropdown (Approved, Declined)
  • Comments - Text Area (to capture the comments by approver)
• A multi-select custom field on the onboarding ticket listing every app a new hire can request — for example, a field named Apps Required. Use whatever field name matches your own account.
• If you want the request routed automatically to a manager, the manager's address is stored on the employee's profile in Okta or Microsoft Entra ID — for example, in a field named Manager. Confirm this matches the field name in your own Okta or Entra ID profile schema.
• If you are not sourcing the manager from Okta or Entra ID, a Lookup Table that maps each employee or department to an approver works the same way.
• Admin access to HappyFox Workflows to create and enable workflows.

Note: How you source each app owner's email address depends on your setup. A Lookup Table mapping app to owner is a common approach, but any method that reliably resolves an owner's address for a given app works equally well.

Setting up Workflow A: Request app access and get manager approval

1. Set the trigger to Ticket Created (or Ticket Updated, if the app list is added after the ticket is opened), and add a filter condition that matches only onboarding tickets — for example, by ticket type or template. See how to set up and combine trigger conditions for guidance on combining multiple filters.
2. Add a Check Condition action that checks whether the Apps Required field includes the first app in your catalog. For each app required, you can create a separate check condition block. 
3. In the block, Add a Create Task action (or Create Task With Task Template, if you use a standard template per app) inside that matched condition, to generate the task for that app.
4. Repeat steps 2 and 3 for every other app in your catalog.

Warning: Each Create Task action must be paired with its own matching condition. Without one, HappyFox Workflows creates a task for every app in your catalog on every onboarding ticket, regardless of which apps the employee actually selected.

5. Add a Get User Info action (Microsoft Entra ID) or Get user by login name action (Okta) to look up the employee's record and retrieve the manager's address from their profile's Manager field.
6. For each requested app, add a Generate Form Link action. Select the access-confirmation form in the Form field, and use Include Metadata to attach the ticket ID and app name to the link.
7. Send the generated link to that app's owner in an individual email.
8. Enable Workflow A.

Setting up Workflow B: Close the task once the app owner confirms access

1. Set the trigger to Form Submitted, filtered to the specific access-confirmation form sent in Workflow A, step 7.
2. Submit the Form with a test entry and complete the trigger set up with the sample trigger data. 
3. Add an Add Private Note action, recording the app name and the decision details from the form response.
4. Add an Update Task action, and set the matching app's task to closed.

Note: Match this step against the ticket ID and app name metadata from the form response, not just the ticket, so that a multi-app request closes only the correct task.

5. Enable Workflow B.

Together, these two workflows turn an onboarding request into a tracked access-approval trail, from the initial task through manager sign-off to the app owner's confirmation.