15.1 Desktop Request Management

For operational needs, companies often implement desktop request management policies—such as device control or print control—to regulate and restrict employee access to corporate resources. If an employee needs to temporarily bypass these restrictions for work purposes, they can submit a request explaining the reason. Once approved by an administrator, the relevant desktop management restrictions can be temporarily lifted under specified conditions.

15.1.1 Request Management

By default, desktop request management allows viewing all requests and supports multiple query methods.

Online Approval:

When the client is online, the steps for submitting and approving desktop requests are as follows:

• The client with "Allow" request permission submits a request.
• A notification appears on the console, and the request record can be viewed under Request Management → Desktop Request Management → Request Management, with the status shown as Pending Approval.
• Double-click the request record to view its details and any attached files. If the administrator finds the requested temporary access or duration inappropriate, they can adjust the request content.
• To approve, click Approve; to reject, click Reject.
• Once approved, the request takes effect when the client executes the Enable action in the desktop request management request window.

Offline Approval:

When the client is offline, the steps for desktop request submission and approval are as follows:

• The client with "Allow" request permission submits a request and clicks Offline Request in the desktop request management window to generate an offline request file.
• The administrator receives the request file, right-clicks Import Request File in the desktop request management interface, and imports the file.
• A notification appears on the console, and the request record can be viewed in desktop request management with the status Pending Approval.
• Double-click the request record to review the request details and any attached files.
• To approve, click Approve; to reject, click Reject.
• Select the approved request record, right-click Export Approval Result, and save the file.
• Send the exported approval result file to the client, who imports it in the request management window and activates the request.

Rejecting a Request

Select one or more requests, then right-click and choose Reject, or click the icon button，and enter the rejection reason to deny the request.

Any administrator with "Reject Approval" permission in the workflow can reject a request. Once rejected, the request is considered denied.

Requests with the status Pending Approval can be rejected. Requests that have been Approved but not yet executed can also be rejected. Even requests currently in execution can be rejected.

Quick Approval

Select multiple requests simultaneously, then click the icon button or choose Quick Approval from the right-click menu. To approve, click Approve; to deny, click Reject.

Delete Requests

Administrators with delete permissions can remove requests from Desktop Request Management. In the management view, select one or more requests and choose a deletion mode: Delete Selected Records, Delete Current Page Records, or Delete All Matching Records.

15.1.2 Delegation of Approval Rights

When an administrator is away, they can temporarily delegate their desktop application approval rights to a trusted administrator. System administrators can also assist other administrators in delegating their rights to designated personnel. During delegation, both the authorization period and the scope of approval rights can be defined. Once the set period expires, the delegated rights are automatically revoked.

Only administrators with the permission path "Application Management -> Desktop Application Management -> Approval Rights Delegation" can delegate their rights. Only administrators with Encryption Management Rights are eligible to receive such delegation. System administrators can view all active delegations.

Delegating Approval Rights

To delegate approval rights to another administrator, follow these steps:

• From the menu bar, go to Application Management -> Desktop Application Management -> Approval Rights Delegation to open the delegation window.
• Click the button to switch to the Delegation Settings view, then click the button to open the Approval Rights Delegation Settings window.
• In the General tab, check Enable Delegation, select the delegate administrator, specify the start and end time of the delegation, and enter any remarks.
• Switch to the Functional Permissions tab, select the rights to delegate (either all or specific permissions), and then click OK to confirm.
• You can then view the details of the delegation under Application Management -> Desktop Application Management -> Approval Rights Delegation -> Delegation Settings.

Sub-delegation of Approval Rights

• With system administrator privileges, click the button in the Desktop Application Approval Delegation interface to switch to View All Delegations, then click the button to open the Sub-delegation Settings window.
• In the General tab, check Enable Delegation, select the delegate administrator, specify the start and end time of the delegation, and enter any remarks.
• Switch to the Functional Permissions tab, select the rights to delegate (either all or specific permissions), and then click OK to confirm.
• You can then view the details of the sub-delegated rights under Application Management -> Desktop Application Management -> Approval Rights Delegation -> View All Delegations.

Automatic Suspension of Delegation

In both delegation and sub-delegation, the General tab provides an option: Automatically suspend delegation when the delegator is online.

If selected, the delegate is granted the assigned rights only when the delegator is not logged into the console. Once the delegator logs in, the delegation is suspended and the delegate's rights are withdrawn.

This setting only withdraws the rights temporarily while the delegator is logged into the console. Once the delegator logs out, the delegate automatically regains the delegated rights. To revoke the rights permanently, the delegation must be deleted in the Approval Rights Delegation interface.

15.1.3 Approval Workflow Management

Desktop Application Management supports workflow configuration with multi-level approvals, ensuring each request is reviewed and verified at the appropriate management levels.

Administrators with the permissions "View Desktop Applications and Approvals" and "Configure Desktop Approval Workflows" can log into the console and navigate to Application Management -> Desktop Application Management -> Approval Workflow Management to access the workflow interface and manage approval processes.

Function Button Descriptions

Search Workflow

Click the Search icon "" to open the search dialog. Enter search criteria such as Name, Application Type, Application Object, or Approver. Fuzzy search is supported. Clicking Search will highlight the first matching result; clicking again will move to the next matching entry.

Create Workflow

Click the New icon "" to create a workflow. Each new workflow includes Basic Settings and Workflow Steps. By default, a newly created workflow is not active. To enable it, select the checkbox in front of the workflow name.

Basic Settings include:

Click the Add icon to create workflow steps. Multiple steps can be added, and each step can be modified, deleted, or moved up and down. At least one step is required to complete the workflow setup.

Workflow step settings include:

Edit Workflow

Click the Edit button to open the workflow editing page, where you can modify the selected workflow's conditions and environment settings.

Copy Workflow

Click the Copy button to duplicate the selected workflow. The copied workflow appears at the top of the list, with its name set to the original workflow name plus _N, where N indicates the copy number relative to the original workflow.

All settings of the copied workflow, including its enabled/disabled status, are identical to the original.

Delete Workflow

Click the Delete button to remove the selected workflow. If there are ongoing requests within the workflow at the time of deletion, those requests will be terminated, and the applicants will receive a corresponding notification.

Automatic Approval

Select a workflow, then click the icon "" and choose Set Automatic Approval to configure automatic approval settings:

Select a workflow with automatic approval enabled, click the icon "" , and choose Cancel Automatic Approval to disable it. Enabling or disabling automatic approval does not alter the original workflow, and requests already in progress remain valid.

Replace Workflow Approvers

Select one or more workflows and click the Replace icon "" to open the Replace Approver dialog. In the dialog, choose the original approver and the new approver. Click OK and save to update the selected workflows with the new approver.

Workflow Matching Rules

Requests are matched to workflows in the order they appear in the approval workflow list, from top to bottom. Once a request matches a workflow, no further matching occurs. If a request does not match any custom workflow, it defaults to the Admin workflow for approval.

Once a request is matched to a workflow, it progresses sequentially through each step. Each step must meet its specified approval criteria before moving to the next step. Only the approvers assigned to the current step can approve; approvers from other steps cannot. A request is considered approved only after all steps have been successfully completed.

If a request is at step N and the required number of approvers approve, it moves to step N+1. If the required number of approvals is not met and any approver rejects, the request reverts to step N-1. Approvers at N-1 do not need to re-approve; if any approver clicks Reject, the request moves back to step N-2. If any approver clicks Comment and provides an explanation that satisfies approval criteria, the request returns to step N.

Desktop Application Management also supports veto operations. Any administrator with Veto Approval rights can reject a request at any stage. Once vetoed, the request is marked as rejected and does not return to a previous step. Requests that have been approved but not yet executed cannot proceed if vetoed.

15.1.4 Automatic Approval Settings

Administrators can grant approvers the permission for automatic approval. Once enabled, requests submitted to the designated approvers will be automatically approved.

Approvers must have the "Allow Automatic Approval" permission to enable this feature. Administrators can assign this permission via the console at Tools -> Account Management -> Functional Permissions -> Desktop Application Management, by checking "Allow Automatic Approval".

Enable Automatic Approval

Approvers can log into the console at Application Management -> Desktop Application Management -> Automatic Approval Settings. Click the Edit icon , check Enable Automatic Approval, and set the active time. By default, it applies all day. You can select a predefined time type from Classification Management -> Time Types, or choose Custom to set a specific time range in the pop-up time selector. Click OK to activate automatic approval.

View Request Details

When a request is automatically approved, the approval action is displayed as "Approved (Automatic)" in the console under Desktop Application Management -> Request Management and on the client under View Desktop Requests -> View Request Details.