Approving action requests
Some device actions can be disruptive to an organization if they are created by mistake or by a disgruntled employee. To prevent this situation, you can configure limits on the number of devices that can be included in requests before a secondary approver is required. The following device actions support dual approval:
- Cryptographic Wipe
-
Delete File
- Freeze
- Remove Freeze
- Run Script
- Send Message
- Unenroll
There is no change to the process of creating a request that requires dual approval. Both the requester and users assigned to a role that is configured for notifications receive an email notification when a new request requiring approval is created. An Action request pending approval event is logged to Events History. You can approve or decline the request in Action Requests.

To approve actions in Pending Approval, your assigned user role must be configured as an Approver.
The request creator cannot approve their own request.
To approve an action Pending Approval:
- Log in to the Secure Endpoint Console as a user with the permission to review the action.
- On the navigation bar, click
History > Action Requests.
-
In Pending Approval on the Action Requests sidebar, click the applicable request name. To find a specific request, do one or more of the following:
- Select an option from the Actions drop-down to filter by type of action.
-
Click
to expand the Search field and enter one of the following:
- The request name
- The last name of the requester
- The script name (only applies to Run Script requests)
- The message name (only applies to Send Message, Freeze, and Remove Freeze requests)
The search results update dynamically as you type. To clear the Search field, click
.
- In the request summary area, click Approve.
- Review the confirmation and click .
The request is approved and moves to either Scheduled or In Progress. An Action request approved event is logged to Events History.

To decline actions in Pending Approval, your assigned user role must be configured as an Approver.
The request creator cannot decline their own request.
To decline an action Pending Approval:
- Log in to the Secure Endpoint Console as a user that has the permission to review the action.
- On the navigation bar, click
History > Action Requests.
-
In Pending Approval on the Action Requests sidebar, click the applicable request name. To find a specific request, do one or more of the following:
- Select an option from the Actions drop-down to filter by type of action.
-
Click
to expand the Search field and enter one of the following:
- The request name
- The last name of the requester
- The script name (only applies to Run Script requests)
- The message name (only applies to Send Message, Freeze, and Remove Freeze requests)
The search results update dynamically as you type. To clear the Search field, click
.
- In the request summary area, click Decline.
- Do one of the following:
Select one of the following predefined reasons for declining the request:
- Action no longer required
- Reschedule request to a later date
- Requires further investigation
- Unauthorized request
- Wrong devices being executed
Select Other and enter the reason that you are declining the request. The reason can be up to 255 characters.
- Click .
The request is declined and moves to Done. An Action request declined event is logged to Events History.

Requests expire after seven days and are automatically declined at midnight UTC seven days after the request is created. Three days before the request expires, an email reminder is sent to the requester and to users assigned to a role that is configured for notifications.
When the request expires, an Action request auto declined event is logged to Events History.

If you created a request that requires approval, you can cancel the request before it is approved or declined.
To cancel an action Pending Approval:
- Log in to the Secure Endpoint Console as the user you used to create the action request.
- On the navigation bar, click
History > Action Requests.
-
In Pending Approval on the Action Requests sidebar, click the applicable request name. To find a specific request, do one or more of the following:
- Select an option from the Actions drop-down to filter by type of action.
-
Click
to expand the Search field and enter one of the following:
- The request name
- The last name of the requester
- The script name (only applies to Run Script requests)
- The message name (only applies to Send Message, Freeze, and Remove Freeze requests)
The search results update dynamically as you type. To clear the Search field, click
.
- In the request summary area, click Cancel request.
- Review the confirmation and click .
The request is canceled and moved to Done. An Action request canceled event is logged to Events History.

Notification emails are sent for device action requests that require approval. Emails are sent to the requester of the device action and to users assigned to a custom role that has been configured for notifications. Notification emails may contain links or buttons to view, approve or decline the request. Emails sent to the requester contain View Details links. Emails send to approvers contain Decline, View Details, and Approve action links.
Clicking View Details opens the request in Action Requests.
Clicking Decline opens the Request decline reason dialog for the request in Action Requests.
Clicking Approve action opens the Approve request dialog for the request in Action Requests.
Notification are sent for the following reasons:
Email type | Recipient | |
---|---|---|
Requester | Approver | |
A new request requiring approval is created | Yes | Yes |
A request requiring approval is declined | Yes | No |
A request requiring approval is nearing expiry | Yes | Yes |
A request requiring approval is auto declined | Yes | No |