title: Workflow Designer category: Workflows & Automation tags: workflow, designer, approval, chains, visual priority: Normal

Workflow Designer

The Workflow Designer is the visual interface for building multi-level approval workflows in IdentityCenter. Located at /access-review/workflows, it provides a drag-and-drop canvas where administrators construct the approval logic that governs access requests, policy remediation, and lifecycle events.

Accessing the Workflow Designer

1. Navigate to Access Reviews > Workflows
2. Click New Workflow to create a new workflow, or select an existing one to edit
3. The visual designer canvas opens with a toolbar of available node types

Workflow Concepts

What is a Workflow?

A workflow is an ordered sequence of steps that determines how a request moves from submission to completion. Each workflow consists of nodes connected by paths that define the approval chain.

Approval Chain Types

IdentityCenter supports two fundamental chain types:

Tip: Use sequential chains when later approvers need context from earlier decisions. Use parallel chains when independent reviewers can evaluate the request simultaneously to reduce overall approval time.

Node Types

Approver Node

The Approver node assigns a person or group to review and approve or deny the request.

Condition Node

The Condition node evaluates an expression and routes the request down different paths based on the result.

Example conditions:

Risk Level = High         --> Route to CISO for approval
Department = Finance      --> Add Finance Manager as approver
Request Type = Privileged --> Require two-level approval

Action Node

The Action node performs an automated operation when the workflow reaches it.

End Node

The End node terminates the workflow with a final status.

Dynamic Approver Resolution

The Approver node supports several methods for determining who should approve:

For full details on resolution methods, fallback logic, and delegation, see Approver Resolution.

Conditional Routing

Condition nodes let you build dynamic workflows that adapt to request context:

Risk-Based Routing

[Start] --> [Condition: Risk Level]
                |
         High ----> [CISO Approval] --> [IT Security Approval] --> [End: Approved]
                |
         Medium --> [Manager Approval] --> [Resource Owner Approval] --> [End: Approved]
                |
         Low -----> [Manager Approval] --> [End: Approved]

Attribute-Based Routing

Route based on any synced attribute: department, title, location, or custom fields. For example, requests from the Finance department may require an additional Compliance Officer review.

Building a Workflow

Step 1: Create the Workflow

1. Click New Workflow
2. Enter a Name and Description
3. Select a Category (Access Request, Policy Remediation, Lifecycle Event)

Step 2: Add Nodes

1. Drag nodes from the toolbar onto the canvas
2. Position them in the desired order
3. Connect nodes by dragging from one node's output port to the next node's input port

Step 3: Configure Each Node

1. Click a node to open its properties panel
2. Set the resolution method, timeout, delegation rules, or condition logic
3. Save the node configuration

Step 4: Define Paths

1. Connect the True and False outputs from Condition nodes to their target nodes
2. Ensure all paths eventually reach an End node
3. The designer highlights any disconnected or orphaned nodes in red

Clone and Template Workflows

Cloning an Existing Workflow

1. From the workflow list, click the three-dot menu on any workflow
2. Select Clone
3. The cloned workflow opens in the designer with a "Copy of" prefix
4. Modify as needed and save with a new name

Using Templates

IdentityCenter includes built-in workflow templates for common scenarios:

To use a template, click New from Template and select the desired starting point.

Save, Test, and Activate

Saving

Click Save at any time to preserve your progress. Saved workflows remain in Draft status until explicitly activated.

Testing

1. Click Test Workflow in the designer toolbar
2. Enter sample request data (requester, resource, risk level)
3. The designer simulates the workflow path, highlighting each node as it would execute
4. Review the simulated path and approver assignments to verify correctness

Tip: Always test with multiple scenarios (different risk levels, departments, and edge cases like missing managers) before activating a workflow.

Activating

1. When testing is complete, click Activate
2. The workflow status changes from Draft to Active
3. Active workflows can be assigned to triggers (see Workflow Triggers)
4. Only one version of a workflow can be active at a time

Deactivating

To modify an active workflow, click Deactivate first. Any in-flight requests will continue on the previously active version. New requests will not use the workflow until it is reactivated.

Best Practices

1. Keep workflows focused -- Design each workflow for a specific purpose rather than building one monolithic workflow for all scenarios
2. Name nodes clearly -- Use descriptive labels like "Finance Director Approval" instead of "Approver 2"
3. Test edge cases -- Simulate what happens when a manager is missing, an approver is on leave, or a condition evaluates unexpectedly
4. Use conditions sparingly -- Overly complex branching makes workflows difficult to maintain and troubleshoot
5. Document your design -- Add a description to each workflow explaining its purpose and expected flow
6. Review quarterly -- As organizational structure changes, verify that approver resolution and routing logic remain accurate

Next Steps

• Workflow Triggers -- Connect workflows to events and schedules
• Approver Resolution -- Understand how approvers are determined
• Escalation & SLA Tracking -- Configure timeouts and escalation rules
• Access Catalog Overview -- See how workflows power the self-service portal
• Access Reviews Overview -- Periodic access certification campaigns
• Policies Overview -- Policy-driven violation workflows