Configure an Approval Workflow for User Offboarding

User Offboarding flows can be configured to require explicit approval before the offboarding process begins. When an Approval Workflow is attached to an offboarding flow, the flow is paused at a designated point and an approver is notified. The flow only proceeds once the approver grants or rejects the request.

This is particularly useful for MSPs that want to enforce a human review step before executing irreversible offboarding actions such as account deletion or license removal.

The tasks in this procedure are performed at the MSP level.

Prerequisites

Role-based access control (RBAC) and permissions

At the customer level:

• Accounts.UserFlows
• Accounts.UserFlows.Read
• Accounts.Users.Offboard

At the MSP level:

• Msp.UserFlows
• Msp.UserFlows.Create
• Msp.UserFlows.Update
• Msp.UserFlows.Page
• Msp.UserFlows.Read

Nerdio Manager roles

The following Nerdio Manager roles allow you to configure Approval Workflows:

• MSP Admins can configure Approval Workflows on User Flow templates and approve or reject pending requests.

Nerdio Manager access levels

Following the Principle of Least Privilege (PoLP), you can define one or more Nerdio Manager custom role(s) to manage User Flows.

Enable an Approval Workflow on a User Offboarding template

1. In Nerdio Manager for MSP, navigate to Shared Settings > Microsoft 365 > User Flows.
2. Open an existing offboarding template by clicking its name, or create a new one.
3. Locate the Approval Workflow setting in the template configuration panel.
4. Enable the Require Approval toggle.
5. In the Approvers field, specify one or more approvers. Approvers can be designated by:
   • A specific Nerdio Manager user
   • A role (e.g., MSP Admin)
6. Optionally, set an Approval Timeout to define how long the flow will wait for a response before auto-cancelling or auto-approving.
7. Click Save or Create to apply the changes.

How approvers review and act on a pending request

When an offboarding flow with an Approval Workflow is triggered, the designated approvers will receive a notification. The flow is paused until a response is received.

1. The approver navigates to Shared Settings > Microsoft 365 > User Flows > Initiated Flows.
2. Flows awaiting approval are shown with an Awaiting Approval status.
3. Click the flow to open its details.
4. Review the offboarding details, including the target user, scheduled actions, and requesting account.
5. Click Approve to allow the flow to proceed, or Reject to cancel it.
6. Optionally, add a comment to record the reason for approval or rejection.

Note: Rejected flows will not execute any remaining actions. Actions that had already completed prior to the approval gate are not reversed.

Need help?

Raise a support ticket for this item.