Skip to main content

​
Background

This article shows you how to configure entitlement-based approvals in the Lumos AppStore. Entitlement-based approvals support cost savings and least-privilege access. If you haven’t set up an app in the AppStore yet, see Adding Apps To Your AppStore

​
Why use entitlements?

Adding an app to your AppStore gives people a fast + easy way to request access. You may have even made a few apps “self-service” so that people can choose the type of access (entitlement) they need. Why fine-tune an app’s entitlement workflows? Here are a couple of scenarios where it makes sense.
  • Cost Differences A Basic Zoom license is usually free, so if someone requests one, it should just be auto-approved. On the other hand, a premium Zoom license costs money, so you might want someone to approve that before it’s granted.
  • Admin Access Someone needs admin access to AWS. That needs to go to a special team for approval, while all other AWS access requests go through a standard approval process.
Read on to learn how to set up approval workflows for specific app entitlements.

​
Steps

​
1. Go to the AppStore setup page.

​
2. Search for your app, click the “Advanced Settings” button, then click the “Permissions” tab.

​
3. To add a new entitlement, click “+Add a permission”. To edit an existing one, click on the entitlement.

If entitlements come from your IdP (i.e. Okta), there will be an IdP logo next to the name of the group. On the entitlement itself, you’ll see an indicator of whether the app is currently hidden or visible to users in the AppStore, as well as the number of entitlement level overrides set on the entitlement itself. More on this in the next step.

​
4. Edit the entitlement settings.

The settings are explained in more detail below.
  • Permission Label This is what people see when they request the entitlement in Lumos, you can change this to make it easier to read. If this entitlement is tied to a group in your IdP, changing the label will not change the name of the group in your IdP.
  • Approvers If you want there to be specific approver(s) for this entitlement, what you set here will override what’s set at the app level.
  • Visible in AppStore If you want to hide an entitlement from requesters altogether, you can toggle this to the left. This is great if certain entitlement types should not be viewed at all.
Next to some entitlement configurations, you’ll see this symbol (linked):
Or this symbol (unlinked):
This indicates whether the entitlement is linkedto the app level configurations. If the entitlement is linked, it means that it is inheriting the app level configuration. That means if you change the app level configuration, the entitlement level configuration will also change. If the entitlement is unlinked, it means that the entitlement is overriding the app level configuration. That means if you change the app level configuration, the entitlement level configuration will not change. This is also the number of overrides you see on the entitlement list in Step 3. To unlink or link an entitlement, click the button.

​
5. Setup complete

​
FAQ

​
If I set an approver for an app, then set a different one for a specific entitlement, what happens?

If that specific entitlement is requested, it will override what’s set at the app level.

​
What happens if multiple entitlements are requested with different workflows?

Each entitlement goes through its own dedicated workflow. Example: If someone requests an entitlement that has a manager approval, and one that needs admin approval, two approval requests will be created — one to each approver.

​
Does changing the Permission Label change the name of the group in my IdP?

No. It only makes the entitlement easier to understand in your AppStore. Lumos still pushes the user to the same group in your IdP if the request is approved.