Change Requests - Non-Reviewers Able to Approve CRs

Chris_Keander

We're setting up our environment for Change Requests and noticed an issue in the Cireson portal where a user who is in the SCSM user role "Change Initiators" but not in the "Change Managers" is able to approve a change request where they are not a reviewer.

Looking at the same CR in the SCSM console, the options to review for this user are grayed out.  Is this a bug?

Chris_Keander

I think I see the issue here.  I only had one AD group created for Change Initiators.  I am creating a new AD group now will just contain users with reviewer permissions and assign that group in the various Review Activity Tasks settings in the admin portal.  Previously I had nothing set there so I assume that meant that any logged in analyst could approve/deny activities.

Sound reasonable?

Joe_Burrows

Chris_Keander said:

I think I see the issue here.  I only had one AD group created for Change Initiators.  I am creating a new AD group now will just contain users with reviewer permissions and assign that group in the various Review Activity Tasks settings in the admin portal.  Previously I had nothing set there so I assume that meant that any logged in analyst could approve/deny activities.

Sound reasonable?

Sounds reasonable

The admin settings scope the viability of the button, all actions are audited in the history of the work item too. 

Chris_Keander

Thanks for your help (again) Joe.  I created a new AD group (SCSM-Change Request Managers) and assigned that group to the Approve and Deny review activities.  Now analysts not in that AD group are not able to approve/deny