End customers find it valuable that their supplier has quick and easy access to troubleshoot their machine or provide service, but from a security perspective it is important that they have full control over who and when can remotely access the machine.

Access request and approval enables you to put the customer in control of remote machine access. Before you can connect to a customer's machine, they must first approve your request, which they are immediately informed about via e-mail and can directly approve with a single click. This ensures that access is only granted when it is needed, and that personnel at the machine can be informed of the external access session.

It provides your customers with greater transparency and peace of mind, while at the same time ensuring a smooth and efficient working relationship.

For more details about how Access request and approval works, see Access request and approval FAQ.

• Configure Access request and approval
• Use Access request and approval

Configure Access request and approval

Make sure that your users can request access.

1. Only users with access to the edge gateway and service (VPN connect, HTTP service, VNC service) can request access. Make sure that your user management is set up correctly.

Make sure there are users that can approve access requests.

2. Go to Admin > Roles and make sure that there is at least one role with permission Approve access requests.
   • Only users with this permission will be able to handle access requests.
3. Go to Admin > Users (or Portal > Users) and make sure that there is at least one user with such a role and with access to the edge gateway where you want to enable Access request and approval.

Enable Access request and approval at the edge gateway's services.

4. Go to Fleet Manager > Devices and click on your device name.
5. Open the settings of a VPN connect, HTTP service, or VNC service.
6. Enable Require access request approval for using this service.
    
   
   • Repeat these steps for every service you wish to require access request approval.
   • You can easily enable this setting on multiple edge gateways using Device templates. Keep in mind that this will apply all service settings from the template and will overwrite all the existing services on the edge gateway.
7. Add the Access Requests component to a Device page or Homepage.
   • On a Device page, this provides you with an overview of all of this device's access requests and also allows you to revoke access.
   • On a Homepage, this provides you with an overview of all devices' access requests and also allows you to revoke access. Limited to the devices you have access to.

Use Access request and approval

Once configured, users with access to the edge gateway and service can request access.

1. Go to Portal > Devices and click on the service you wish to access.
   • Requesting access for an HTTP server will open a new tab and can be cancelled by closing the tab. Requesting access for either VPN connect or a VNC service will open a dialogue in the current tab and can be cancelled by clicking Cancel.
   • You can also request access at edge gateways that are currently offline, enabling you to request access for a later date and time when the edge gateway is expected to be online.
      
2. Fill in the request form (details below) and click on Send request.
   

   Field	Description
   Select service	Select the service(s) (VPN, HTTP, VNC) to which you would like to request access. You can select multiple services Note that you only see services that your role gives you access to.
   Send access request to	Select the user(s) who you would like to request for access. You can select multiple users. The selected user(s) will be notified via e-mail and they can directly approve the request from the e-mail. If you cannot select a user, then no user with access to this edge gateway has the required permission Approve access requests. Please contact your IXON Cloud company administrator.
   Reason for requesting access	Make sure to provide sufficient information so your request can be approved easily.
   From	Select the start date and time when you'd like to connect.
   Duration	Select for how long you would like to have access. It is advisable to select slightly longer than necessary, so you have some extra room to work with in case you need it.

3. Wait for your access request to be approved.
   • The selected user(s) have been notified via e-mail about your request.
   • You will be notified via e-mail once your access has been approved, rejected, or revoked.
   • Access requests that are not yet accepted or rejected can be resent from the Access Requests component on a Device page or Homepage. This will resend the original access request e-mail.
   • If your request has been approved but the start time has not passed yet, you cannot connect yet. On hover, it will show the start date and time when you can connect. On click, you can make a new access request.
      
   • If your request has been approved and the start time has passed, you can connect, as indicated by the unlocked icon. On hover it will show the end time (and date if it's not today).