Question

Contoso uses entitlement management to grant contractors access to project resources through an access package. The compliance team requires that whenever a contractor's access request is approved, a record must be created in an external ticketing system by calling a REST API, and the access grant must not complete until the API confirms the ticket was created. You need to configure this in the access package. What should you do?

Accepted Answer

Create a Logic App and add a custom extension (custom workflow extension) to the catalog, then configure the access package policy to launch the extension and wait for a callback during the request-granted stage.

Answer

Configure an Azure Logic App triggered by an audit log event for approved requests, using entitlement management's built-in provisioning logs as the trigger.

Answer

Add a multi-stage approval policy where the second stage approver is a service account that calls the ticketing API before approving.

Answer

Enable an access review on the access package and configure the reviewer to be the ticketing system's managed identity so the API is invoked automatically.