Are there any implementations (such as Active Directory) that have applied separation of duties to user account creation, which would require the create user account task and approval task to be done by two different users?

For example, if an administrator with the necessary privileges tries to create a user account, the administrator would not be able to proceed until the other user has approved it on the system.

  • I've seen implementations where if any user (new or old) is given admin privs, email alerts are sent out.
    – schroeder
    Nov 11, 2018 at 21:16

2 Answers 2


In Active Directory this can be done with the help of third-party solutions that can provide approval-based workflow. Here's our solution that allows you to do that (it's a solution that we provide which illustrates the approach)

The operation can be sent for approval only if certain conditions are met (e.g. if the initiator is not a member of IT staff group).


Many third party IAM (Identity and Access Management) tools offer exactly what you're looking for and can hook into whatever identity store you're using (AD, other LDAP server, RADIUS, SQL DB, AWS IAM, etc), but I'm not aware of an identity store that offers this functionality inherently.

As some examples you could look at OIM (https://www.oracle.com/technetwork/middleware/id-mgmt/overview/index.html) or ForgeRock (https://www.forgerock.com/platform/identity-management) but it's also entirely possible to home-grow a solution for this, and I'm sure there are some other competitors in the IAM market, this is not an endorsement for either of those products, they're just ones I know off the top of my head.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .