Rules like Naming Conventions and Lifecycles make a great base for fostering well-structured workspaces; however, if you're after truly effective governance, you should implement the 4-eyed principle and set up a thorough Approval Process.
With Teams Manager, when a user decides to submit a new request for a Team, they'll have to fill out the Metadata fields you've created. Depending on your Policy Setup, certain Metadata might apply a specific Policy Package to the Team.
Once the user's request is finalized, the Admin (or the Approver Group/User Principal) receives an Adaptive Card via the Teams Manager Bot and is prompted to review the request.
During this review, they have the opportunity to change Team details or leave comments for the original requester to resolve.
Once the request is approved, the Admin (or a member of the Approver Group) is notified about the successful creation of the Team in question.
With Request Forwarding, if the initial Approver doesn't Approve or Reject a Request within a certain timeframe, it's moved to a secondary Approver Group, ensuring that no Request is left hanging.
Let's take a step-by-step walkthrough of the Approval Process to fully understand how this procedure applies to real-world workflows.
✅ Approving Requests
Navigate to the Requests tab in Teams Manager to get started.
You'll be presented with a list of all Active Requests on your tenant.
Click on the requested Team's name to get a summary of the information specified by the user.
You'll end up on the Update request pop-up, where you can change details specified by the user, add Owners and Members, and edit Metadata fields.
Clicking Next will display all of the Team characteristics, including Basic info, Metadata, and Policy. Click on Approve to actually create the requested Team.
Once the request has been approved, the newly created Team will be added to your tenant, complete with all of the information and rules that you saw on the final review screen.
👥 Creating Approver Groups
An Approver Group is a collection of individuals within your organization who can approve new Teams. For instance, you can create a "Marketing Department" approver group and allow people in it to approve new Marketing Spaces.
Navigate to Settings > Approval to get started.
You'll notice that there's already a Default approver group present; you (the Admin) will be its sole member. Members of the Default approver group get to approve all requests, as opposed to other Approver Groups, which have to be a part of the corresponding Policy.
Click on + Add a group to create a new Approver Group.
Specify a Name and a Description for your Approver Group and add the people who will be able to approve Teams from now on. Once done, click on Create to save your group.
Simply creating a group won't automatically grant its members the ability to Approve Teams; you need to specify this newly created Approver Group in a Policy Package.
Navigate to Settings > Policies and click on the Policy you'd like to edit. If you don't have a Policy yet, you can just create one.
Once you're on the Edit the policy package screen, click next until you end up on the Approval Step.
Here you can:
Enable/Disable Approvals in general by changing the state of the Enable request and approval flow toggle.
Select whether Requests are sent to an Approver Group or the Requester's Manager, and select your newly created Approver Group for all Teams that are created through the Template that this Policy governs.
Designate a Backup Approver Group in case the Requester doesn't have a Manager specified in Entra ID.
Enable Request Forwarding.
🔒 Set Security Groups as Approvers
Teams Manager also allows you to base your Approver Group on an existing Microsoft Entra Security Group.
Navigate to Settings > Approval > + Add a group, specify the desired Name and Description, and type in the name of the preferred Security Group into the Approver box.
Selecting a Microsoft Entra Security Group in the Approver box will automatically add all of its members to the newly created Approver Group.
⏩ Request Forwarding and Manager Approval
What happens when Approvers forget or disregard a Request? Until now, Requesters had to track down an Approver themselves. With Request Forwarding, you can assign an additional Approver Group, ensuring no Request is left hanging.
There's also the addition of Manager Approval that allows you to designate Approvals to the Requester's Manager (specified in Entra).
This means that Managers can approve Requests that originate from their Departments, simplifying the Approval Process across your organization.
🧩 Request Forwarding Logic
The Request Forwarding Flow ensures that there are backup Approval layers for each Request.
There are two possible scenarios:
Regular Request Forwarding - There's a 1st Level Approval Group that must approve the Request within a certain timeframe (e.g., 7 days). If they don't Approve or Reject it within the given timeframe, the Request goes to the 2nd Level Approver Group.
Request Forwarding with Managerial Approval - The Request goes directly to the Approver's Manager (specified in Entra). If the Requester doesn't have an assigned Manager, it goes to the Backup 1st Level Approver Group. If the Manager or Backup Group doesn't Approve or Reject the Request within a certain timeframe, it goes to the 2nd Level Approver Group.
⚙️ Request Forwarding Setup
Request Forwarding can be set up when either Creating or Editing a Policy Package, during the Approval step.
Here's how it's done:
Start Creating or Editing a Policy Package and get to the Approval step.
Make sure that the Enable request and approval group toggle is enabled (If you disable it, Teams under this Policy Package will be created instantly)
Select where you want to send the Requests, to an Approver group or the User's principal (manager). If you chose the latter, also select a Backup 1st-level approver group (this is the Group that takes over when the Requester doesn't have an assigned Manager).
Make sure that the Enable 2nd-level approval toggle is on.
Set the 1st-level response time. This is the timeframe within which the 1st-level Approvers must Approve or Reject the Request before it's sent out to the 2nd-level Approver Group.
Click on Next and finalize the rest of your Policy Package.
That's it, you've successfully enabled Request Forwarding.
💼 Assigning Managers
If you want Managers to Approve the Requests that originate in their departments, you'll need to make sure that everyone, or the majority of your employees, has an assigned Manager in Entra ID.
Here's how it's done:
Sign in to the Microsoft Entra Admin Center.
Navigate to Entra ID > Users from the sidebar.
Select the desired User and click on Edit Properties.
Choose the Job Information tab at the top.
Click on + Add manager and select the User that you want to assign as Manager.
Click Select and Save.
Now, in cases when this User submits a Request for a Template with a Managerial Approval Policy, the assigned Manager will receive their Request.
🏅 Final results
Once Approver Groups and Request Forwarding are set up:
The initial Request will go to the corresponding Approver Group/User's Manager (in case of regular single-step Approval), or the designated 1st-level Approver Group/User's Manager (in case of Request Forwarding)
If the User doesn't have an assigned Manager, their Request will go to the Backup Approver Group.
If the Manager or Approver Group fails to Approve or Reject the Request within a certain timeframe, it will be moved to the 2nd-level Approver Group.
⛑️ Need more help?
Get further assistance with Teams Manager through our support chat widget within the app, or reach out to us at support@solutions2share.com