What are Approvals in Azure Enclave?

Approvals in Azure Enclave provide another layer of governance and oversight for critical infrastructure operations. This feature enables administrators to queue requests to create new resources or modify existing resources, while requiring explicit approval before changes are implemented. This provides an additional control for users who have permissions to make changes; their changes would require additional approval(s) before the change is made.

Consider these Approvals scenarios:

• You're the community cyber expert and want the administrator team to create new enclaves, but you need to approve enclave creation. Add yourself as a required approver for new enclaves.
• The community cyber team must review new enclave connections to help maintain community security and isolation. Add a security group for the community cyber team as a required approver for enclave connection creation and updates.
• You're an enclave owner who hosts a shared web app. You created an enclave endpoint for other enclaves to connect to your web app. You trust three people to review changes to that endpoint for availability and security. Add a security group as a required approver for connections to the enclave endpoint.

Prerequisites

Before you configure or use approvals, complete these prerequisites:

• Assign users or groups to the Enclave Approver Role so they can review requests.
• Add those users or groups (with the Enclave Approver Role) to the mandatory approvers for each approval setting as needed. You determine if any action needs mandatory approvals.
• Confirm your planned users who submit changes are different from the users who approve changes.
• Make sure your approvers can access the community or enclave scopes where requests are created.

If you don't complete this role assignment first, requests can enter a pending state without an available approver.

Why use Approvals?

Approvals help organizations maintain strict governance and security standards for sensitive environments by:

• Enforcing separation of duties: Ensuring that the person requesting a change isn't the same person approving it.
• Preventing unauthorized changes: Requiring explicit approval before critical infrastructure modifications take effect.
• Enhancing audit trails: Creating a comprehensive record of who requested changes, who approved them, and when.
• Reducing risk: Catching potential misconfigurations or unauthorized changes before they're deployed.
• Supporting compliance requirements: Meeting regulatory requirements for change management and oversight.
• Enabling controlled deployments: Allowing teams to prepare changes while requiring management oversight before execution.

How Approvals work

The Approvals workflow in Azure Enclave follows these key steps:

1. Request submission: A user with appropriate permissions initiates an action that requires approval, such as creating an enclave connection or modifying an endpoint.
2. Pending state: The requested change enters a pending state and is queued for review.
3. Approval review: Users with the Enclave Approver Role can review pending approval requests.
4. Decision: An approver either approves or rejects the request with optional comments.
5. Implementation: After an approval decision, an approved request can proceed to implementation, while a rejected request doesn't proceed.

Roles and permissions

The Approvals feature integrates with the Azure Enclave role-based access control (RBAC):

Enclave Approver Role

The Enclave Approver Role manages approval requests:

• Read-only access to all Azure Enclave resource types
• Explicit permissions to approve or reject pending approval requests
• Can't initiate changes: This role is strictly for oversight and approval
• Audit visibility: Can view the full history of approval requests and decisions

Other relevant roles

• Enclave Owner/Contributor: Can submit requests that require approval but can't self-approve
• Community Owner/Contributor: Can submit community-level requests requiring approval
• Enclave Reader: Can view pending approvals but can't approve or reject them

Learn more about Azure Enclave RBAC roles

Integration with Azure Privileged Identity Management

Combine approvals with Azure Privileged Identity Management (PIM) for enhanced security:

• Just-in-time approver access: Grant the Enclave Approver Role on a time-limited basis through PIM
• Multi-factor authentication: Require MFA for approval actions
• Approval for approvers: Require a secondary approval before granting approver permissions
• Comprehensive audit logs: Track all approval activities across both Azure Enclave and PIM

Learn more about Just-in-Time Access.

Monitoring and auditing

You can log and audit all approval activities:

• Azure Activity Logs: All approval and rejection actions are logged in Azure Activity Logs.
• Log Analytics: You can query and analyze approval patterns and trends.
• Microsoft Sentinel: You can integrate approval logs with your security monitoring.

Resource actions with approvals eligible

When you enable the Approvals feature for a resource action, that action requires approval:

Community actions

• Community endpoint updates: Modifying community endpoint configurations that control access to trusted resources outside the community.
• Enclave endpoint updates: Modifying endpoint configurations that control access to workloads in enclaves.
• Enclave creation: Creating a new enclave.
• Connection creation: Creating new connections between enclaves or to external resources.
• Connection updates: Modifying existing connections between enclaves or to external resources.
• Enclave maintenance mode: Modifying maintenance mode on an enclave, including turning maintenance mode on or off.

Enclave actions

• Enclave endpoint updates: Modifying endpoint configurations that control access to workloads in the enclave.
• Connection creation: Creating new connections from the enclave to other enclaves or external resources.
• Connection updates: Modifying existing connections from the enclave to other enclaves or external resources.
• Enclave maintenance mode: Modifying maintenance mode on the enclave, including turning maintenance mode on or off.

You can configure the specific operations that require approval in the community configuration based on your organization's governance requirements.

Approval states

Approval requests can have the following states:

Best practices

When implementing Approvals in your Azure Enclave environment:

• Assign dedicated approvers: Designate specific individuals or teams as approvers to maintain separation of duties.
• Define approval policies: Clearly document which changes require approval and the approval criteria.
• Set SLAs for approvals: Establish timeframes for approval decisions to prevent deployment delays.
• Use descriptive justifications: Require requesters to provide detailed justifications for their change requests.
• Regular audit reviews: Periodically review approval logs to identify patterns and improve processes.
• Combine with PIM: Use time-bound approver access for sensitive environments.
• Document rejection reasons: When rejecting requests, provide clear feedback to help requesters understand why.
• Ticket Id: If you're using a change management tool, include the change management ID in the approval request.

Enclave creation flow comparison

The following diagram illustrates how enclave creation differs when approvals are disabled versus enabled:

Next steps

• Configure Approvals in Azure Enclave
• Manage approval requests
• Learn about Just-in-Time Access
• Understand Azure Enclave RBAC
• Create an enclave connection with approvals