App Approvals

You can control the cost of your application licenses with the integration of the app approvals workflow in Omnissa Intelligence, Omnissa Workspace ONE UEM, and ServiceNow.

Many Win32 applications have expensive licenses. You can use app approvals to restrict who can install these applications and to control the cost to manage these resources.

The integration brings several systems together to process app approval requests.

• Omnissa Workspace ONE UEM: Manages the application and distributes it to the Omnissa Workspace ONE Intelligent Hub catalog on devices.
• Omnissa Intelligence: Communicates between your ServiceNow environment and your Workspace ONE UEM deployment.
• ServiceNow: Manages the request and the approval process.

How do app approvals work?

App approvals start with a user requesting to install an app on a Windows device.

1. Users request to install applications through the Workspace ONE Intelligent Hub app on their devices.
2. Intelligence sends requests to ServiceNow. The requests contain information about users, devices, and requested applications.
3. ServiceNow processes requests according to Flows (configured in ServiceNow) and according to company policies.
4. ServiceNow sends responses back to Intelligence. Responses include approvals or rejections.
   • Approvals result in the automatic installation of applications.
   • Rejections result in returns to Request states in the Workspace ONE Intelligent Hub.
5. If approved, Workspace ONE UEM sends the app to Workspace ONE Intelligent Hub for installing on the device.

Requirements

Have the listed integrations, systems, and settings configured before using app approvals.

• Use Workspace ONE UEM version required for Intelligence.
• Register Workspace ONE UEM with Intelligence.
• Have a ServiceNow instance with the ServiceNow Integration Hub plugin, and register ServiceNow with Intelligence.
• Use Hub Services and use the Intelligent Hub app as your app catalog.
• Use Windows devices.
• Use native apps managed in Workspace ONE UEM (internal, public, and purchased).
• Know about app assignments in Workspace ONE UEM.

Example of what Intelligence sends in the request

To start the request process, Intelligence sends a request like the sample code to ServiceNow. Requests include details about users, devices, and applications requested for installation.

{
  "RequestId": "bffb4469-56fb-4141-9ab0-0897f65143ba",
  "RequestFor": {
    "UserId": "15",
    "UserAttributes": {
      "user_name": "username",
      "last_name": "user",
      "first_name": "name",
      "email": "username@example.com"
    }
  },
  "Domain": "${domain}",
  "DeviceId": 123,
  "DeviceProperties": {
    "name": "Device Name",
    "device_udid": "F11C43E8307092418D7D5B0D9B48F235",
    "platform": "Windows 10"
  },
  "Notes": "Notes",
  "CatalogItem": {
    "Id": "267",
    "Name": "App Name",
    "Categories": null,
    "Properties": {
      "package_id": "{12345A78-40C1-2702-0000-000004000000}",
      "version": "9.20.0",
      "platform": "WinRT"
    }
  },
  "DueDate": 1568989813956,
  "Links": {
    "ApprovalNotify": {
      "Url": "<CallbackURL>"
    }
  }
}

1. Set up ServiceNow to handle incoming app requests

Set up ServiceNow to handle incoming, app requests so that you can customize your instance and approval policies. This process uses the ServiceNow's Scripted REST API capability.

For details on scripted REST APIs in ServiceNow, access Create a scripted REST API.

1. Log in to ServiceNow and use the All search text box to find the Scripted REST API feature in the System Web Services area.
2. Complete the following configurations.
   
   • Name: Enter a descriptive name, like Workspace ONE App Approval.
   • API ID: Enter appapproval.
   • API namespace: Record this value because you enter it in Intelligence in step 5 of this procedure.
3. On the Resources tab, complete the following configurations.
   • Add a resource.
     
   • Name: Enter Request.
   • HTTP method: Select POST.
   • Relative path: Check that this entry is /request.
   • Resource path: Ensure that this field reads /api/<namespace>/appapproval/request.
     • If the path is not in this format, the request fails.
     • To fix, check that the scripted REST API and resource have the correct names.
   • Script: Enter a script to match your environment.
     • You can customize the offered sample code for your deployment.
     • You can create a cart item within a request or link the user name to your system's SYSID.
     • Store values as part of the ServiceNow Request.
     • Storing the values compiles the outgoing API request after the request ticket is approved or rejected.

Sample code for the scripted REST API resource

(function process(/*RESTAPIRequest*/ request, /*RESTAPIResponse*/ response) {
    var RequestID = request.body.data.RequestId;
    var CallbackURL = request.body.data.Links.ApprovalNotify.Url;
    var DeviceID = request.body.data.DeviceId;
    var Notes = request.body.data.Notes;
    var AppName = request.body.data.CatalogItem.Name;
    var UserID = request.body.data.RequestFor.UserId;
    var UserName = request.body.data.RequestFor.UserAttributes.user_name;
    var FirstName = request.body.data.RequestFor.UserAttributes.first_name;
    var LastName = request.body.data.RequestFor.UserAttributes.last_name;
    gs.info("Request Recieved");
    var create = new GlideRecord('sc_request');
    create.initialize();
    create.setValue('short_description',"Request for Installation of " + AppName);
    create.setValue('description',FirstName + " " + LastName + " Requests Installation of " + AppName);
    create.setValue('u_uem_callback_url',CallbackURL);
    create.setValue('u_uem_notes',Notes);
    create.setValue('u_uem_device_id',DeviceID);
    create.setValue('u_uem_request_id',RequestID);
    create.setValue('u_uem_user_id',UserID);
    create.setValue('u_requesting_user',UserName);
     
    create.insert();
     
    response.setStatus(200);
})(request, response);

2. Add custom fields to the request ticket in ServiceNow

Add custom fields to the app request ticket with tables in ServiceNow. Custom fields help to compile the outgoing approval and rejection API requests to Intelligence.

1. In the All search text box at the top of the ServiceNow admin console, enter Tables and scroll to select System Definition > Tables.

2. In the Name search text box, enter sc_request to find the Request definitions.

3. Select the Request table.

4. Add columns by adding required values the system returns to Intelligence, and add their respective value in the API request. When you are done entering the values, select Update and save the table.
   

   Type	Column Label	Column Name	Max Length
   String	UEM Callback URL	u_uem_callback_url	2048
   Integer	UEM Device ID	u_uem_device_id	40
   String	UEM Request ID	u_uem_request_id	40
   Integer	UEM User ID	u_uem_user_id	40
   String	Requesting User	u_requesting_user	40
   String	UEM Notes	u_uem_notes	4000

   
   

Optionally, you can work in the ServiceNow console area System UI > Form Sections to hide columns and values from the UI. Hiding columns and values sets them to be used only in API requests.

3. Configure an approval action in ServiceNow

Use the Flow Designer, Workflow Studio to add an action for the approval or rejection response sent to Intelligence for the installation of the applicable UEM application.

1. In ServiceNow, use the All search text box to find the Flow Designer.
2. Select New and select Action.
   You are now in the Workflow Studio area of the console.
3. Complete these settings to get started with the action.
   • For the Action Name, enter a name that helps identify the action. For example, you can enter AppName-AppApproval.
   • You can leave the default settings for the other options unless you want to configure other settings. For example you could add a description or select a Category > Service Catalog.
   • Select to Build action to continue.
4. Configure the Inputs for the action using the Create Input menu option. Add the listed inputs.
   
   • Request ID
   • Device ID
   • Updated By
   • Notes
   • Updated At
   • Callback URL
   • Approval
5. Add a Script step by selecting the plus sign (+) in the Action Outline section and searching for script. The script step converts the approval status string to uppercase to prepare for the API call.
   
   • Required Runtime: You can leave this as Instance.
   • Input Variables: Use the Create Variable menu option to define the input variable Name > approval_status and Value > action > Approval.
   • Script: Add the sample code that converts the approval status to uppercase.

     (function execute(inputs, outputs) {
     var approval_lc = inputs.approval_status;
     outputs.approvalstatus = approval_lc.toUpperCase();
     })(inputs, outputs);
   

   • If this step fails: Leave the default value, Stop the action and go to error evaluation.
6. Add a REST step to the action.
   
   • Complete the Connection Details.
     • Connection: Select Use Connection Alias.
     • Connection Alias: Select the applicable alias from the drop-down list.
     • Base URL: Unlock and override the base URL using the lock button. Then use the data picker to select the Input > Callback URL.
   • Complete the listed Request Details. Leave other settings as default.
     • Build Request: Select From REST Message.
     • HTTP Method: Select POST.
     • Headers: Name = Content-Type and Value = application/json
   • Complete the Request Content sections.
     • Request Type: Select Text.
     • Request Body[Text]: Add the listed script.
       

       {
         "data":{
           "request_id": "action-Request ID", 
           "device_id": "action-Device ID", 
           "approval_status": "step-Script step-ApprovalStatus", 
           "updated_by": "action-Updated By", 
           "notes" : "action-Notes", 
           "updated_at" : "action-Updated At"
           }
         }
       

7. Add Outputs by using the Create Output option to add the Label > ApprovalStatus as a String.
8. Save the action.

4. Create a flow in ServiceNow

In ServiceNow, create a Flow with the approval action depending on your organization's approval policies.

Access Create a workflow for the latest documentation on working in ServiceNow.

1. Use the All search text box to find the Flow Designer.
2. Select New and select Flow.
   You are now in the Workflow Studio area of the console.
3. Name the flow and start building it.
4. Complete the Trigger settings.
   
   • In the Trigger text box, select Updated to find changes in the ticket statuses.
   • For Table, search and select Request [sc_request].
   • Define a Condition as [Approval - is one of - Approved, Rejected] and [UEM Callback URL - is not empty].
   • For Run Trigger, select Once.
5. Add an Action.
   
   • In the Action Properties, add the AppName-AppApproval action you created in step 3.
   • In the Action Inputs, add appropriate values using the Trigger - Record Updated > Request Record > option that match the required action inputs.
6. Save and activate the flow and check that the flow is published.

5. Add scripted REST API namespace to Intelligence

1. In Intelligence, go to Integrations > Workflow Connectors > ServiceNow.
2. Edit the connection to include the API Namespace. You recorded this value while adding the Scripted REST API to ServiceNow.
   

6. Require approval in UEM

To require approval, add or edit an app assignment in Workspace ONE UEM. Adding or editing an app assignment to require approval activates users to request to install apps with the Workspace ONE Intelligent Hub on Windows devices.

For details about adding and editing assignments to apps in UEM, see Add Assignments and Exclusions to your Applications.

1. In the Workspace ONE UEM console, navigate to the appropriate app and add or edit an assignment.
2. On the Distribution tab, activate the Require Approval To Install menu option.
   

On the device

In the Workspace ONE Intelligent Hub app catalog on the device, users select the app and then can request access to the app from the catalog. Users can enter a justification to initiate the app request process. After the request is approved by the appropriate individual through ServiceNow, the system installs the app.

UEM app approval statuses

Statuses in the Workspace ONE UEM console and in the Workspace ONE Intelligent Hub on devices represent specific steps in the request and approval process for app approvals.

Admins can view the status of an app approval in the Workspace ONE UEM console, in the Resources > Apps area or in the Devices area by selecting the app that requires approval or selecting the device requesting the app.

Workspace ONE Intelligent Hub app approval statuses

Users access the app through the Workspace ONE Intelligent Hub. They select Request to initiate an installation. After initiating a request, the Workspace ONE Intelligent Hub displays a status to identify where in the process the request for installation exists.