Contents

Microsoft Application Approval Workflow Administrator's Guide
Contents

Overview.. 1

Introduction. 1

Prerequisite Concepts. 2

Guide Workflow.. 3

Installation Prerequisites. 3

Environment Prerequisites. 3

Security Prerequisites. 3

Other Prerequisites. 4

For Support 4

Rollback Procedures. 4

Installation. 5

Install Application Approval Workflow (Part 1) 5

Install Application Approval Workflow (Part 2) 10

Uninstall Application Approval Workflow.. 16

Uninstall Application Approval Workflow from Orchestrator Server 16

Uninstall Application Approval Workflow from Service Manager Server 17

Repair Application Approval Workflow.. 18

Before You Proceed. 20

Application Approval Workflow Resources. 20

Configuration. 21

Runbook Configuration. 21

Create and Synchronize the Connector. 22

How to Create an Active Directory Connector 22

How to Create an Orchestrator Connector 22

How to Synchronize a Connector 22

Verify Application Synchronization, Templates, and Users. 23

How to Verify Initial Application Synchronization. 23

How to Verify That There Is a Template. 23

How to Verify That There Are Users. 23

Create and View Application Approval Workflow Requests. 23

How to View Application Approval Requests (Administrator) 24

How to View Application Requests (User) 24

How to View Applications Associated with Approval Requests. 24

How to Create Application Approval Requests. 25

How to Approve Application Approval Requests. 25

How to Deny Application Approval Requests. 25

Create, Rank, and Edit Selection Criteria. 25

How to Create Selection Criteria. 26

How to Rank Selection Criteria. 26

How to Edit Selection Criteria. 27

How to Run a Selection Criteria Simulation. 28

How to Create an Application Approval Workflow Request Template. 28

How to Modify an Existing Application Approval Workflow Request Template. 29

How to Create a Copy of a Template. 29

Deleting a Template. 29

How to Manage Applications and Users as Groups. 30

How to Create an Activity. 30

Reports Configuration. 30

How to view Application Approval Workflow Report in Data Warehouse. 30

Appendix A: Personas and Scenarios. 32

Appendix B: Troubleshooting. 33

Troubleshooting Installer 33

Troubleshooting Runbooks. 33

Troubleshooting Configuration. 38

Appendix C: Tips and Tricks. 39

Copyright © 2012 Microsoft. All rights reserved.


Overview

Overview

Microsoft® Application Approval Workflow (AAW) is a Microsoft Solution Accelerator for the Microsoft System Center 2012 platform. This solution enhances the Microsoft System Center 2012 Configuration Manager application approval process using Microsoft System Center 2012 - Service Manager service request templates, enabling flexible approver lists.

With AAW, enterprises can realize the benefits of infrastructure as a service while simultaneously using their existing investments in Service Manager, Microsoft System Center 2012 - Orchestrator, and Configuration Manager. Enabling a distributed application approval workflow process for System Center enhances the self-service experience.

Related Topics

Introduction


Introduction

Introduction

IT organizations considering AAW need to examine and adapt their existing tools, processes, workflows, and automation to meet the requirements of an effective AAW implementation. Although it is critical that the underlying components (such as the Service Manager Portal, Service Manager request infrastructure, notifications, workflows, and automation) integrate well with each other and account for industry-wide best practices, the work involved to ensure an effective AAW implementation can be daunting and time-consuming. AAW addresses these concerns by allowing administrators to configure application requirements to meet their own needs.

In adopting AAW, enterprises can benefit from the existing features and functionality already available in the System Center suite. IT can tailor the solution to meet the needs of the business—for example, the Service Manager platform allows organizations to better manage application allocation and distribution. AAW enables administrators to add approval criteria to the process. For example, for the allocation of a specific application that has limited licenses, administrators can require manager approval before the application is distributed, allowing administrators to configure the application requirements accordingly.

The benefits AAW offers the enterprise include:

· A well-tested and fully supported AAW solution that accounts for industry-wide best practices

· Customization and extension of the AAW experience, natively supported by the System Center suite of products

· Reduced cost, effort, and time to deploy AAW to organizations that already use the System Center platform

The benefits that AAW offers consumers of IT within the enterprise include:

· Standardized and well-defined processes for requesting and managing application approval criteria

· Natively supported request, approval, and notification to enable businesses to effectively manage their own application allocation.

Overview


Prerequisite Concepts

Prerequisite Concepts

The goal of Service Manager is to support IT service management in a broad sense. This support includes implementing IT Infrastructure Library (ITIL) processes such as change management and incident management. It can also include other processes, such as allocating resources from a private cloud.

Service Manager maintains a configuration management database. This database is the repository for most configuration- and management-related information in the System Center 2012 environment.

When a user requests an application through the Configuration Manager Application Catalog that requires approval, this approval workflow solution transforms the application request into a Service Manager service request, allowing flexible approval lists and activities.

Service Manager starts a workflow to handle the request. It sends the user’s manager or appropriate approver a request, which the approver can approve or deny. If the request is approved, the workflow then starts an Orchestrator runbook.

A runbook is essentially another kind of workflow. Although a Service Manager workflow is designed to implement ITIL-style processes, a runbook is designed to interact directly with system management tools. Orchestrator provides a range of prebuilt components to interact with other technologies (including non-Microsoft management tools). The runbooks included in the solution are designed to interact with Service Manager. The runbook relies on Orchestrator components to ask Service Manager to create a new application approval request. AAW routes the request to the appropriate approvers using the Service Manager workflow capabilities.


Guide Workflow

Guide Workflow

This guide helps Service Manager administrators:

· Install AAW

· Configure AAW

· Enable self-service requests in the Service Manager

· Help service providers fulfill AAW requests

Figure 1 shows the workflow for the steps described in this guide.

Figure 1. Application Approval Workflow

Installation Prerequisites


Installation Prerequisites

Installation Prerequisites

Before installing AAW, ensure that you have met these prerequisites.


Environment Prerequisites

Environment Prerequisites

· System Center 2012 - Service Manager

· System Center 2012 - Orchestrator

· System Center 2012 - Configuration Manager

· Microsoft Visual C++ 2010 x64 Redistributable – 10.0.30319

Installation Prerequisites


Security Prerequisites

Security Prerequisites

Installation of AAW:

· Service Manager:

· The person who installs Service Manager should be a member of the Service Manager Administrator role.

· Orchestrator:

· The person who installs Orchestrator should be an administrator in the Orchestrator database. (Local administrator privilege is required.)

· Configuration Manager:

· Security credentials are required for connecting to Configuration Manager.

· The ability to remotely access the Windows® Management Instrumentation (WMI) provider on Configuration Manager is required. You need to be added to a group that has access. How this is done depends on your environment setup (refer to Authorize WMI users and set permissions ).

Runbook Server:

· Orchestrator Runbook service

· Orchestrator Management service account

· The service account for the Orchestrator Management Service must have the following:

· Permission to log on to the management server as a service (This right is automatically granted during the installation process.)

· The service accounts are OrchestratorSystemGroup and OrchestratorUsersGroup

· Member of the Microsoft.SystemCenter.Orchestrator.Admins role in the Orchestrator database (The account is automatically added to this role during the installation process.)

Installation Prerequisites


Other Prerequisites

Other Prerequisites

· Configuration Manager—site name for Configuration Manager

· Service Manager—register the Data Warehouse

· Microsoft System Center Integration Pack for System Center 2012 Service Manager

Installation Prerequisites


For Support

For Support

· Contact Microsoft Support at http://support.microsoft.com.

Installation Prerequisites


Rollback Procedures

Rollback Procedures

AAW will be removed automatically if the setup fails when importing the Solution Accelerator. This removal will not affect the next installation.

Installation Prerequisites


Installation

Installation

Use these procedures to install AAW. There are two parts to the installer. The first part should be installed on the Service Manager server; the second part should be installed on the Orchestrator server. Launch Application Approval Workflow Setup on the Service Manager server when complete. Launch the same Setup (Application Approval Workflow Setup) on the Orchestrator server.


Install Application Approval Workflow (Part 1)

Install Application Approval Workflow (Part 1)

The installation of AAW on the Service Manager server installs the necessary management packs. The administrator can define the required application approval workflows to direct incoming application requests from the Configuration Manager Application Catalog.

1. Open the Microsoft Application Approval Workflow Setup Wizard, and click Install Application Approval Workflow components for Service Manager (see Figure 2).

Figure 2. Install Application Approval Workflow components for Service Manager

2. On the Software License Terms page, read and accept the license terms, and then click Next (see Figure 3).

Figure 3. Software license terms

3. On the Installation Location page, review and verify that the correct items are selected, and then click Next (see Figure 4).

Figure 4. Installation Location

4. On the Installation summary page, click Install (see Figure 5).

Figure 5. Installation summary

5. On the Installation completed successfully page, review the details of the installation, and then click Close (see Figure 6).

Figure 6. Installation completed successfully

Installation


Install Application Approval Workflow (Part 2)

Install Application Approval Workflow (Part 2)

The installation of AAW on the Orchestrator server installs the necessary runbooks.

1. Open the Microsoft Application Approval Workflow Setup Wizard, and click Install Application Approval Workflow components for Orchestrator (see Figure 7).

Figure 7. Install Application Approval Workflow components for Orchestrator

2. On the Software License Terms page, read and accept the license terms, and then click Next (see Figure 8).

Figure 8. Software License Terms

3. On the Installation Location page, review and verify that the correct items are selected, and then click Next (see Figure 9).

Figure 9. Installation Location

4. On the Configuration Manager settings page (Figure 10), provide the following information:

· Configuration Manager Server Name. The name of the Configuration Manager server

· User name. The name of the Configuration manager administrator

· Password. The password of the Configuration manager administrator account

· Configuration Manager site code

Determine the Configuration Manager site code:

· Open System Center 2012 Configuration Manager Console

· Click Administration, you will find Site Code under Overview -> Site Configuration -> Site

The next two values refer to the frequency with which Configuration Manager is polled for new requests:

· Sync applications every. Sixty minutes is the default, but the value depends on the frequency you require your organization’s applications to be pulled from the Configuration Manager server. The recommended time for a large organization is every 60 minutes.

· Sync application requests every. Thirty minutes is the default, but the value depends on the frequency you require your organization’s application requests to be pulled from the Configuration Manager server. The recommended time for a large organization is every 30 minutes.

Click Next.

Figure 10. Configuration Manager settings

5. On the Service Manager settings page (see Figure 11), provide the following information:

· Service Manager Server. The name of the Service Manager server

· User name. The name of the Service Manager administrator

· Password. The password for the Service Manager administrator account

· Sync application requests every. Thirty minutes is the default, but the value depends on the frequency you require your organization’s application requests to be pulled from the Service Manager server. The recommended time for a large organization is every 15 minutes.

Click Next.

Figure 11. Service Manager settings

6. On the Installation summary page, click Install (see Figure 12).

Figure 12. Installation summary

7. On the Installation completed successfully page (see Figure 13), review the details of the installation, and then click Close.

Figure 13. Installation completed successfully

Installation


Uninstall Application Approval Workflow

Uninstall Application Approval Workflow


Uninstall Application Approval Workflow from Orchestrator Server

Uninstall Application Approval Workflow from Orchestrator Server

You can uninstall AAW from Control Panel. To do so, you must be an administrator on Orchestrator Server administrator.

On the Uninstall or change a program page, select AAW, and then click Uninstall, as shown in Figure 14.

Note: Before Uninstallation of AAW make sure to:

· Stop all running Application Approval Workflow runbooks

· Manually delete all Application Approval Workflow runbooks

· On the orchestrator Server the Wizard will be displayed as shown in Figure 14.

· Figure 14. Repair / uninstall AAW on Orchestrator Server

Uninstall Application Approval Workflow


Uninstall Application Approval Workflow from Service Manager Server

Uninstall Application Approval Workflow from Service Manager Server

You can uninstall AAW from Control Panel. To do so, you must be an administrator on Service Manager administrator.

On the Uninstall or change a program page, select AAW, and then click Uninstall, as shown in Figure 15.

Note: Before Uninstallation of AAW make sure to:

· Delete the Management Packs that store the AAW templates

· Close all the AAW Consoles (Service Manager) and Documents (CHM files)

Figure 15. Uninstall AAW

Uninstall Application Approval Workflow


Repair Application Approval Workflow

Repair Application Approval Workflow

You can repair AAW from the Control Panel. To do so, you must be an administrator on the machine on which the program is installed as well as a Service Manager administrator.

On the Uninstall or change a program page, select AAW, and then click Uninstall, as shown in Figure 16.

Figure 16. Repair AAW

And on the Service Manager Server the Wizard will be as shown in figure 17

Figure 17. Repair / Uninstall AAW on Service Manager Server

By selecting Repair Application Approval Workflow components for Service Manager, the wizard will take you through the installer, excluding the Software License Terms page and repair the installation.

The Repair option on the Orchestrator server will re-deploy all AAW files and will create a new runbook file with the parameters provided by the user during the installation (replacing the old one). To verify Application Approval Workflow works fine, please delete the old runbooks and import the new ones.

The repair function on the Service Manager server will re-deploy all missing AAW management packs and files.

Before You Proceed


Before You Proceed

Before You Proceed

AAW is used for configuration and management of AAW requests. The AAW resources—accounts, services, and connectors—must be created and configured before you start to set up selection criteria for applications.


Application Approval Workflow Resources

Application Approval Workflow Resources

Table 1 describes the AAW resources that must be created and configured in the infrastructure before you perform the procedures in the section, “Configuration,” later in this guide.

Table 1. Application Approval Workflow Resources

Item | Description
Accounts | All accounts must be set up correctly.
Services | All services must be running and set up with the correct accounts.
Active Directory®/Service Manager connector | Connector from Active Directory Domain Services (AD DS) to Service Manager.
Orchestrator/Service Manager connector | Connector from Orchestrator to Service Manager.

Before You Proceed


Configuration

Configuration

This section describes the steps that the administrator performs in Service Manager to enable AAW request scenarios. An administrator first creates the Active Directory connector. A connector imports data from System Center and/or AD DS to the Service Manager database. Connectors must import your users and groups.

Related Topics

Runbook Configuration
Create and Synchronize the Connector
Verify Application Synchronization, Templates, and Users
Create and View Application Approval Workflow Requests
Create, Rank, and Edit Selection Criteria
Reports Configuration


Runbook Configuration

Runbook Configuration

After installing AAW, import and configure the Orchestrator runbooks.

To import runbooks

8. Log on to the Orchestrator server on which AAW was installed.

9. Open the Runbook Designer.

10. Navigate to the Runbooks node.

11. Right-click the node, and then click Import.

12. Browse to the runbooks folder in AAW_installation_folder (where AAW_installation_folder is the default location unless you installed the application elsewhere—generally, it is located in Program Files(x86)).

13. Select Runbooks.OIS_Export in the runbooks folder.

14. Click Finish in the Import Options Wizard.

The AAW runbooks are imported into the Runbook Designer.

To configure global settings

15. Navigate to the Variables node under Global Settings.

16. Review all the settings, and configure for your environment.

17. You may choose to enable logging under Logging Settings by setting Enable Logging to True.

For additional configuration settings, refer to Configuration Troubleshooting .

To start the runbooks

18. Open the Runbook Designer.

19. Navigate to the Runbooks node.

20. Navigate to and select the Automation node under Application Approval Workflow.

21. For each of the following tabs, click Run (the green arrow) in the top menu bar:

· Application Catalog Synchronization

· Application Request Synchronization

· Automation Monitor

· Poll Service Manager

Note: Make sure all four are started.

22. Close the Runbook Designer.

This step only needs to be performed once after installation. Going forward, the runbooks will continue to run on the scheduled intervals.

Configuration


Create and Synchronize the Connector

Create and Synchronize the Connector

Use these procedures to create connectors using the Service Manager console. Connector data coming from external systems that are imported into the database can be edited using the standard Service Manager forms. This is not recommended when the external source is regarded as the master data source such as the application data objects coming in from Configuration Manager. Changes made in Service Manager to these application data objects will be overwritten by the synchronization process.


In this section

In this section

· Create an Active Directory connector.

· Create an Orchestrator connector.

· Synchronize a connector.

Create and Synchronize the Connector


How to Create an Active Directory Connector

How to Create an Active Directory Connector

Use the following procedure in Service Manager to create, validate, and confirm the status of an Active Directory connector to import user and group objects from AD DS.

To create an Active Directory connector

1. In the Service Manager console, click Administration.

2. In the Administration pane, expand Administration, and then click Connectors.

3. In the Tasks pane, under Connectors, click Create Connector, and then click Active Directory Connector.

4. Follow the instructions at http://technet.microsoft.com/en-us/library/hh519597.aspx to create an Active Directory connector.

Create and Synchronize the Connector


How to Create an Orchestrator Connector

How to Create an Orchestrator Connector

Use the following procedure in Service Manager to create, validate, and confirm the status of an Orchestrator connector.

To create an Orchestrator connector

1. In the Service Manager console, click Administration.

2. In the Administration pane, expand Administration, and then click Connectors.

3. In the Tasks pane, under Connectors, click Create Connector, and then click Orchestrator Connector.

4. Follow the instructions at http://technet.microsoft.com/en-us/library/hh519779.aspx to create a connector.

Create and Synchronize the Connector


How to Synchronize a Connector

How to Synchronize a Connector

To synchronize a connector

1. In the Service Manager console, click Administration.

2. In the Administration pane, expand Administration, and then click Connectors.

3. In the Connectors pane, select the connector to synchronize.

4. In the Tasks pane, click Synchronize Now.

Create and Synchronize the Connector


Verify Application Synchronization, Templates, and Users

Verify Application Synchronization, Templates, and Users

Related Topics

Configuration
In this section
How to Verify Initial Application Synchronization
How to Verify That There Is a Template
How to Verify That There Are Users


In this section

In this section

· Verify initial application synchronization.

· Verify that there is a template.

· Verify that there are users.

· Verify that there are AAW runbooks in the library.

Verify Application Synchronization, Templates, and Users


How to Verify Initial Application Synchronization

How to Verify Initial Application Synchronization

Use the following procedure to verify that the initial applications have been synchronized.

To verify initial application synchronization

1. In the Service Manager console, click Configuration Items.

2. In the Configuration Items pane, click Application Catalog.

In the Application Catalog area, verify that the applications are there. If they are not, in the Tasks pane, click Sync Now.

3. For additional assistance, see Appendix B: Troubleshooting.

Verify Application Synchronization, Templates, and Users


How to Verify That There Is a Template

How to Verify That There Is a Template

Use the following procedure to verify that there is a template to create application approval requests.

To verify that a template exists

1. In the Service Manager console, click Library.

2. In the Library, click Templates.

3. Search for Application Approval Workflow Template or Management Pack. Microsoft recommends creating a new management pack.

4. If no template or management pack exists, create a template. For instructions on how to do so, see How to Create an Application Approval Workflow Request Template later in this guide.

Verify Application Synchronization, Templates, and Users


How to Verify That There Are Users

How to Verify That There Are Users

Use the following procedure to verify that there are users to create application approval requests.

To verify there are users

1. In the Service Manager console, click Configuration Items.

2. In the Configuration Items pane, click Users.

3. In the Users area, verify that the appropriate users are there. If you do not see the appropriate users, see Appendix B: Troubleshooting.

Verify Application Synchronization, Templates, and Users


Create and View Application Approval Workflow Requests

Create and View Application Approval Workflow Requests

Related Topics

Configuration
In this section
How to View Application Approval Requests (Administrator)
How to View Application Requests (User)
How to View Applications Associated with Approval Requests
How to Create Application Approval Requests
How to Approve Application Approval Requests
How to Deny Application Approval Requests


In this section

In this section

· View application approval requests (administrator).

· View application approval requests (user).

· View applications associated with approval requests.

· Create application approval requests.

· Approve application approval requests.

· Deny application approval requests.

Create and View Application Approval Workflow Requests


How to View Application Approval Requests (Administrator)

How to View Application Approval Requests (Administrator)

Use the following procedure to view application approval requests. The administrator performs these tasks in the Service Manager console.

To view the status of application approval requests

1. In the Service Manager console, click Work Items.

2. In the Work Items pane, click Application Requests.

3. Choose the appropriate category from the five categories of application requests listed to see the status of the request:

· All Active Application Requests

· All Approved Application Requests

· All Denied Application Requests

· All Failed Application Requests

· All Cancelled Application Requests

4. To open the form and view the details, double-click Application Request.

5. If you do not see the application requests, see Appendix B: Troubleshooting.

Create and View Application Approval Workflow Requests


How to View Application Requests (User)

How to View Application Requests (User)

Use the following procedure to view application approval requests. The user performs these tasks in the Configuration Manager Portal.

1. In the Software Center from the Start Menu, click Find additional applications from the Application Catalog.

2. On the Application Catalog page, select My Application Requests.

3. On the My Application Requests page, select the request to view, and then click VIEW HISTORY.

Create and View Application Approval Workflow Requests


How to View Applications Associated with Approval Requests

How to View Applications Associated with Approval Requests

Use the following procedure to view applications associated with approval requests. Doing so can give you an idea of how often applications are requested to gauge high-volume application request generators.

To view the history of application approval requests

1. In the Service Manager console, click Configuration Items.

2. In the Configuration Items pane, click Application Catalog.

3. Under Application Catalog, click Applications Associated with Application Requests.

4. To open the form, double-click the appropriate application approval request.

5. On the application’s Properties page, click History to show all of the changes that have been made to an application approval request.

6. Click OK.

Create and View Application Approval Workflow Requests


How to Create Application Approval Requests

How to Create Application Approval Requests

Use the following procedure to create application approval requests in Configuration Manager.

To create application approval requests

1. In the Configuration Manager Application Catalog, you will see a list of applications that are available and ready for installation. Select the application you want to request, and then click REQUEST.

2. You can find additional applications by clicking Find additional applications from the application catalog in Software Center.

3. In the Reason for application request (required) box, type the reason for your request, and then click SUBMIT.

After submitting, you will see the Your request has been submitted page.

Create and View Application Approval Workflow Requests


How to Approve Application Approval Requests

How to Approve Application Approval Requests

Use the following procedure to approve application approval requests in the Service Manager Portal.

To approve application approval requests

1. In the My Activities pane of SMPortal, click My Activities.

2. In the My Activities area, to view the details of an In Progress application approval request, click Parent work item then click See details. Under Default application request, click the green arrow to return to the My Activities page.

3. In the Select a reviewer check box, select your name, and then click Approve.

4. In the Enter comment box, type a comment, and then click Save.

After saving, you will see the approved date and a green check mark next to the reviewer’s name.

Create and View Application Approval Workflow Requests


How to Deny Application Approval Requests

How to Deny Application Approval Requests

Use the following procedure to deny application approval requests.

To deny application approval requests

1. In the My Activities pane of SMPortal, click My Activities.

2. In the My Activities area to view the details of an In Progress application approval request, click Parent work item then click the See details. Under Default application request, click the green arrow to return to the My Activities page.

3. In the Select a reviewer box, select your name, and then click Deny.

4. In the Enter comment box, type a comment, and then click Save.

After saving, you will see the denied date and a red X next to the reviewer’s name.

Create and View Application Approval Workflow Requests


Create, Rank, and Edit Selection Criteria

Create, Rank, and Edit Selection Criteria

Administrators can define the approval criteria for applications to control who can be approved for AAW requests. Using the Selection Criteria Wizard, you can create custom templates with defined criteria. When a request comes in from Configuration Manager, depending on who the users are, the group of which they are a member, and what application is being requested, the request can be processed accordingly. Note that status for Selection Criteria must be set to Production.

Related Topics

Configuration
In this section
How to Create Selection Criteria
How to Rank Selection Criteria
How to Edit Selection Criteria
How to Run a Selection Criteria Simulation
How to Create an Application Approval Workflow Request Template
How to Modify an Existing Application Approval Workflow Request Template
How to Create a Copy of a Template
Deleting a Template
How to Manage Applications and Users as Groups
How to Create an Activity


In this section

In this section

· Create selection criteria.

· Rank selection criteria.

· Edit selection criteria.

· Run a selection criteria simulation.

· Create an AAW request template.

· Modify an existing AAW request template.

· Create a copy of a template.

· Manage applications and users as groups.

· Create an activity.

Create, Rank, and Edit Selection Criteria


How to Create Selection Criteria

How to Create Selection Criteria

Use the following procedure to create selection criteria for applications.

To create selection criteria for applications

1. In the Service Manager console, click Administration.

2. In the Administration pane, click Application Approval. Click Selection Criteria, and then click Create Selection Criteria Wizard in the Tasks pane.

3. The Create Selection Criteria Wizard opens.

4. On the Before You Begin wizard page, click Next.

5. On the General page:

· In the Name box, type a name—for example, type Selection Criteria for Development Applications.

· In the Description box, type a name—for example, type Selection Criteria for Development Applications.

· Next to the Template box, click Browse:

· On the Select Template page, under Templates, select the template you want, and then click OK.

6. On the Selection Criteria page, click Application, and then click Add.

7. In the Select objects dialog box, Click Add and add the applications you want, and then click Next.

8. On the Selection Criteria page, click Users, and then click Add.

9. In the Select objects dialog box, Add the users you want, and then click OK.

Note By selecting Include Application Objects, you can select Applications.

Note By clearing the Include Application Objects check box, you are implying that this rule will apply only to user objects.

Note By selecting Include User Objects, you can select users.

Note By clearing the Include User Objects check box, you are implying that this rule will apply only to application objects.

Note By selecting both Include User Objects and Include Application Objects, you are implying that this rule will apply to both application and user objects.

10. Click Next.

11. On the Reviewers page, to Add Approvers by clicking the Add button next to the “Approvers” grid

· On the “Reviewer” pop-up window specify the desired approver and click OK

12. Click Next.

13. On the Summary page, verify the settings, and click Create.

14. On the Completion page, verify the results, and click Close.

Create, Rank, and Edit Selection Criteria


How to Rank Selection Criteria

How to Rank Selection Criteria

Use the following procedure to rank selection criteria for applications.

To rank selection criteria for applications

1. In the Service Manager console, click Administration.

2. In the Administration pane, click Application Approval, and then click Selection Criteria.

· To increase the priority of the application approval, select the selection criteria, and then click Increase Rank.

· To decrease the priority of the application approval, select the selection criteria, and then click Decrease Rank.

· To move an application with the highest priority to the top, select the selection criteria and then click Top Rank.

· To move an application with the lowest priority to the bottom, select the selection criteria, and then click Bottom Rank.

3. Ensure that Multi-select is enabled.

Create, Rank, and Edit Selection Criteria


How to Edit Selection Criteria

How to Edit Selection Criteria

Use the following procedure to edit selection criteria for application approval requests. In this scenario, a user will be deleted so that he or she will not be a match to request an application.

To edit selection criteria for application approval requests

1. In the Service Manager console, click Administration.

2. In the Administration pane, click Application Approval, and then click Selection Criteria.

3. In the Selection Criteria View pane, select the desired Selection Criteria.

4. In the Tasks pane, click Edit Selection Criteria Wizard.

The Edit Selection Criteria Wizard opens.

In one scenario, you can delete the users:

1. On the Selection Criteria page, click Users.

2. Under User column, select the user, and then click Delete.

3. In the Would you like to delete selected items dialog box, click Yes, and then click OK.

4. You can run another defined selection criteria simulation by following the steps in the section, How to Run a Selection Criteria Simulation

In another scenario, you can delete all users by clearing the Include Users Objects check box:

1. In the Service Manager console, click Administration.

2. In the Administration pane, click Application Approval, and then click Selection Criteria.

3. In the Selection Criteria pane, click the appropriate application.

4. In the Tasks pane, click Edit Selection Criteria Wizard.

The Edit Selection Criteria Wizard opens.

5. On the Selection Criteria page, click Users.

6. Under User column, select the user, and then click Delete. Repeat this step for all of the other users.

7. Clear the Include Users Objects check box.

8. In the Would you like to delete selected items dialog box, click Yes, and then click OK.

9. You can run another selection criteria simulation by following the steps in the section, How to Run a Selection Criteria Simulation

Create, Rank, and Edit Selection Criteria


How to Run a Selection Criteria Simulation

How to Run a Selection Criteria Simulation

Use the following procedure to run a simulation for selection criteria. Doing so shows you whether the selection criteria for an AAW template and a user are a match. This is a helpful tool for the administrator in cases where users repeatedly request applications but the requests are not approved or processed.

To run a simulation for selection criteria for a user and an application match

1. In the Service Manager console, click Administration.

2. In the Administration pane, click Application Approval, and then click Selection Criteria.

3. In the Tasks pane, click Run simulation.

4. On the Incoming Request page, type the user’s name in the User box, or click …. to search for the user.

5. Next to the Application box, click Browse.

6. In the Select objects dialog box, select the application you want, and then click OK.

7. On the Incoming Request page, click Run.

8. In the Microsoft Application Approval Workflow dialog box, click OK.

9. On the Incoming Request page, click Close.

The Selection Criteria should have a status of Test. Select the Selection criteria, and in the Tasks pane, click Change Status.

10. In the New Status box, select Production, and then click OK.

Alternatively, you can change the status of an invalid template or a template that is not working correctly by selecting Disabled in the New Status box.

Note Change the selection criteria status to Production if you want it to be used during request processing.

11. Click Close.

Create, Rank, and Edit Selection Criteria


How to Create an Application Approval Workflow Request Template

How to Create an Application Approval Workflow Request Template

Use the following procedure to create an AAW request template.

To create an AAW request template

1. In the Service Manager console, click Library.

2. In the Library pane, click Templates.

3. Click Create Template.

4. On the Create Template page:

a. Type the new template name in the Name box.

b. Type the new template description in the Description box.

c. Next to the Class box, click Browse.

5. On the Select a Class page, under All basic classes, select Application Request, and then click OK.

6. If it is the first template you will be creating for AAW, next to Management Pack, click New.

7. On the Create Management Pack page:

d. Type the Management Pack name in the Name box.

e. Type the Management Pack description in the Description box, and then click OK.

8. Create an activity.

Create, Rank, and Edit Selection Criteria


How to Modify an Existing Application Approval Workflow Request Template

How to Modify an Existing Application Approval Workflow Request Template

Use the following procedure to make changes to an existing AAW request template. In this scenario, a reviewer will be added and provided the ability to veto, validate, and review application approval requests. Best practice when creating templates is to keep the template details generic and, when you use the template in defining a specific workflow approval, add activities specific to the required approval tasks.

Note: It is strongly recommended not to modify activities in an AAW template once linked to any Production Selection Criteria. It would lead to Application request synchronization failure.

To modify an existing template

1. In the Service Manager console, click Administration.

2. In the Administration pane, click Application Approval, and then click Selection Criteria.

3. In the Selection Criteria view pane, select the Selection Criteria with the AAW request template you want to change.

4. In the Tasks pane, click Edit Selection Criteria Wizard.

5. In the Edit Selection Criteria Wizard, on the General page, click Open.

6. On the Create Template page, click OK.

7. On the Service Request Template page, click Activities.

8. Open the Review Activity.

9. Now you can modify the Review Activities to accommodate your specific scenario.

Create, Rank, and Edit Selection Criteria


How to Create a Copy of a Template

How to Create a Copy of a Template

Use the following procedure to create a copy of an existing AAW request template. You can create baseline templates, for example, for all applications that require manager approval. After you create a copy of a template, modify the activities to apply the template to all of the applications or groups of applications. See the section, How to Modify an Existing Application Approval Workflow Request Template, to modify the activities of a template.

To create a copy of a template

1. In the Service Manager console, click Library.

2. In the Library pane, click Templates.

3. In the Templates area, select the template to copy.

4. In the Tasks pane, click Duplicate.

5. On the Select management pack page, click OK.

6. In the Templates area, select the template that was copied.

Notice that the old title remains but will have the word Copy appended to the title.

7. In the Tasks pane, click Properties.

8. On the Create Template page, in the Name box, type the new name of the template, and then click OK.

Create, Rank, and Edit Selection Criteria


Deleting a Template

Deleting a Template

Caution By deleting a template, all selection criteria related to the original template will be invalid. Avoid deleting a template, if possible.

Create, Rank, and Edit Selection Criteria


How to Manage Applications and Users as Groups

How to Manage Applications and Users as Groups

You can create baseline templates to apply templates to all of your applications or groups of applications. Use this procedure to manage applications and users as groups rather than individuals.

To manage requests as groups

1. In the Service Manager console, click Administration.

2. In the Administration pane, click Application Approval, and then click Selection Criteria.

3. In the Selection Criteria pane, select the AAW request template you want to manage as a group of applications—for example, you might have a template named Selection Criteria for Development Applications.

4. In the Edit Selection Criteria Wizard, on the Selection Criteria page, under Application tab, select all of the applications, and then click OK.

5. In the Would you like to delete selected items dialog box, click Yes, and then click Delete

6. In the Edit Selection Criteria Wizard, on the Selection Criteria page, under Application tab, click Add Group, and then click OK.

7. On the Select objects page, select a group—for example, Developers Applications.

8. In the Edit Selection Criteria Wizard, on the Selection Criteria page, select Include Users Objects, and then click Users.

9. In the Edit Selection Criteria Wizard, on the Selection Criteria page, under Users, click Add Group, select the group of users you want to add, and then click OK.

Create, Rank, and Edit Selection Criteria


How to Create an Activity

How to Create an Activity

You can create an activity for a template—for example, a Review activity that allows you to assign this task to individuals or a group for approval.

To create an activity

1. In the Service Manager console, navigate to Library and click on Templates.

2. In the View pane search and Select your application request template, click Properties and then click “OK” to open the application request template.

3. Navigate to the Activities tab of the Application request Template and click Add.

4. As an example, select Default Review Activity, and then click OK.

5. Provide a title for your review activity.

6. Review these options:

· If you want the line manager to approve, select Line Manager.

· If you want to define individuals, click Add in the Reviewers pane.

· Select Reviewers, and then click OK.

7. Review your approval condition.

8. Click OK, and then close the activity by clicking OK.

Create, Rank, and Edit Selection Criteria


Reports Configuration

Reports Configuration

User can view the reports in the Data Warehouse by following the instructions in the following sections.


How to view Application Approval Workflow Report in Data Warehouse

How to view Application Approval Workflow Report in Data Warehouse

You can view the application approval workflow reports in the Data Warehouse by following the below steps.

1. In Service Manager, click Administration.

2. In the Administration pane, click Register with Service Manager Data Warehouse to register Service Manager to Data Warehouse.

3. In Service Manager, click Data Warehouse, and then click Data Warehouse Jobs.

4. In the Data Warehouse Jobs pane, click MPSyncJob, and then click Resume.

5. After MPSyncJob finish, click Data Warehouse, then click Management Packs, verify the following management packs are deployed successfully.

a. Microsoft Application Approval Workflow Core

b. Microsoft Application Approval Workflow Data Warehouse Library

c. Microsoft Application Approval Workflow Report Library

d. Microsoft Application Approval Workflow UI

6. In Service Manager, click Data Warehouse, and then click Data Warehouse Jobs.

7. On Data Warehouse Jobs pane, click the following jobs in sequence.

a. Extract_SMManagement_GroupName

b. Transform.Common

c. Load.common

8. Now report data should be in the Application Approval Workflow Report.

9. Click Reporting wonderbar in Service Manager, and then click Application Approval Workflow Report. You can see all pending application requests and all approved\denied requests from here.

Note:

To make sure the Data Warehouse is working properly, on both Service Manager Server and Data Warehouse Server, add a new inbound rule in the Windows Firewall with Advanced Security with the TCPport 1433 for the SQL instance.

10.

Reports Configuration


Appendix A: Personas and Scenarios

Appendix A: Personas and Scenarios

This appendix defines the different personas, or roles, and responsibilities of those personas when using the Microsoft Application Approval Workflow Administrator’s Guide to create and manage AAW requests.

Consumer (User): Requests an application from the Configuration Manager Application Catalog.

Consumer (Approver): Approves or denies application requests from the Service Manager Portal.

Provider (Application Administrator):

1. Defines and maintains AAW criteria for specific:

· Applications or application groups

· Users or user groups

2. Assigns approvers—for example, a line manager who needs to provide approval

3. Reviews application approval requests in the Service Manager console

4. Manages, defines, and maintains AAW criteria templates:

· Reorders the sequence in which workflow approval criteria should be executed

· Creates default templates that can apply to multiple applications, application groups, users, or user groups

· Runs simulations before implementing criteria

· Allows additional templates and activities


Appendix B: Troubleshooting

Appendix B: Troubleshooting


In this appendix

In this appendix

· Troubleshooting Installer

· Troubleshooting Runbooks

· Troubleshooting Configuration

Appendix B: Troubleshooting


Troubleshooting Installer

Troubleshooting Installer

This appendix provides some issues and solutions for the AAW installer

Issue: Installer failed, yet no error message was shown.

Details: Start by viewing the installation logs found at:

%TEMP%\Microsoft_Application_Approval_Workflow_<DateTime.log

%TEMP%\Microsoft_Application_Approval_Workflow_<DateTime><trycount >_AAWSetup.log”

Appendix B: Troubleshooting


Troubleshooting Runbooks

Troubleshooting Runbooks

This appendix provides some examples and solutions when trying to start the runbooks.

Issue: Runbook shows a WMI error.

Details:

A few of the runbook executions are stuck and not proceeding with the execution.

And when running the runbook, you get the following error in the logs:

Solution: Verify that you can remotely access the WMI provider in Configuration Manager. You need to be added to a group that has access. This is environment specific, refer to Authorize WMI users and set permissions:

Issue: Runbook shows an object reference not set to an instance of an object.

Details: When running the runbook, you get the following error in the logs:

Solution: Verify that you have configured the firewall for WMI access. For more information, see Connecting Through Windows Firewall .

Issue: Cannot start runbook ‘Create or Update Application instance in SM.’

Details: The specified account may be missing privileges required to invoke a runbook. Add the account to the Orchestrator System Group to give it the required authority:

Reason: The runbook is trying to call another runbook. In this case, the account running this runbook is required to be a member of Orchestrator System Group.

Solution: Two groups are created under Server Manager\Configuration\Local Users and Groups\Groups during installation of Orchestrator server: one is Orchestrator System Group, and the other is Orchestrator User Group. Depending on your environment setup, the domain administrator is in Orchestrator User Group only. In Orchestrator System Group, only the service account Domain\Account is there.

To fix this problem, add the security account specified for this Invoke Runbook activity. To get the security account, find the failure “Invoke Runbook” activity, double click on it and go to “Security” page.

Issue: Warning: The object “Process Application Instance” in the policy “Create or Update Application instance in SM” failed.

Details: The user requested that this platform event be generated if the object fails:

Reason: The running runbook activity has script -OPD_SMOperationResult = applicationCatalog.ProcessApplicationInstance(anInstance, out errorMessage).ToString().

The result returned from ProcessApplicationInstance is assigned to the OPD_SMOperationResult variable:

In the run behavior of that activity, the Report if the activity fails to run check box is selected. That is what “The user requested” means:

Solution: Verify whether assemblies included in the “Advanced” step are ready in a specified location (the custom SCO assembly folder). Debug from code, if necessary.

Issue: Warning: The policy “Create or Update Application instance in SM” failed.

Details: The user requested that this platform event be generated if the policy fails:

Reason: “Warning: The object ‘Process Application Instance’ in the policy ‘Create or Update Application instance in SM’ failed.”

Solution: Fix the failure from “Warning: The object ‘Process Application Instance’ in the Policy ‘Create or Update Application instance in SM’ failed.”

Issue: A few of the runbook executions are stuck and not proceeding with the execution.

Details: The runbook execution is in progress for a long time, and multiple runbooks are stuck at a particular step:

Reason: The problem is that the automation is queuing up application request synchronization instances, because previous instances have not yet finished. If (time to execute application request synchronization) > (application request polling frequency), then this will happen. In this situation, the number of queued automation runbook instances will rapidly grow (within its job concurrency settings).

Solution: Decrease polling frequency, use Microsoft SQL Server® configuration, use faster hardware, or provision an additional runbook server to spread the workload.

Issue: Unable to reset runbook counters.

Details: Orchestrator does not provide any way to reset the runbook counters.

Solution: AAW provides a way to reset the runbook counters. Open Runbook Designer, navigate to the Automation runbook, and then select the Reset Counters runbook, which resets all the counters for AAW.

Appendix B: Troubleshooting


Troubleshooting Configuration

Troubleshooting Configuration

This section provides troubleshooting steps for configuration issues.

Issue: No logs are generated for the runbook execution.

Details: The logs for the runbook execution are not generated during the runbook execution.

Reason: Logging is not turned on in Runbook Designer.

Solution:

23. Navigate to the Global Settings node in Runbook Designer.

24. Verify the following settings under the Logging Configuration node:

· Verify whether EnableLogging and EnableVerboseLogging are set to True.

· Verify the LogFileLocation. The default location can be modified if you want the logs to be generated to a different place other than the one specified.

Appendix B: Troubleshooting


Appendix C: Tips and Tricks

Appendix C: Tips and Tricks

This appendix includes items that are good to know and that could save a call to the help desk:

· All approvers should be in the Service Manager Activity Implementers role.

· All approvers should be granted proper access to the Service Manager Portal.

· If the Service Manager Portal is not showing the Activities defined in approval request to the approver, make sure the approver has the correct privileges.

· Service Manager credentials and Configuration Manager credentials provided in the environment configuration must be a member of the Orchestrator System Group.

· The status of Selection Criteria must be Production. Selection Criteria with Test status is only for simulation purpose.

· After any AAW template is linked to selection criteria, it should not be deleted if the corresponding selection criteria is still in use. You will get unexpected results.