Since the release of SCCM 1810, one of the feature that I wanted to test was approve SCCM application requests via email. I believe this is really a good feature and I am sure admins would be very happy.
The application approval feature of Configuration Manager would allow admins to approve application requests for users per device. When the user first requests application, it gets listed under Approval Requests. The administrator had to visit Approval Requests section and manually approve the request.
To know more about what I am talking about, here is my post on approve application requests for users per device. However the new approve SCCM application requests via email is really a great addition. We will look more about it in the next section.
Note – In my testing I found that once you specify email addresses and deploy the application, you cannot change or modify them later. Neither in application properties nor deployment settings. So ensure that you specify correct email address.
This post covers the steps to approve SCCM application requests via email. The steps that I am performing are done on SCCM version 1810.
If you are still not on SCCM 1810, refer the SCCM 1810 step by step guide to upgrade your configuration manager. Note that Approve Application Requests via Email feature is available starting with SCCM 1810 only.
Approve SCCM Application Requests via Email
To implement and test the approve application requests via email feature, we will breakdown the whole process into steps. This will help you to understand it better.
Note that every step is important and in-case you get stuck at any step, feel free to put your question in the comments section.
Step 1 – Enable Approve Application Requests for Users Per Device
First of all you need to enable a feature called Approve application requests for users per device. To do so :-
- Launch Configuration Manager console.
- Click Administration > Overview > Updates and Servicing > Features.
- On the right pane, right click Approve application requests for users per device and click Turn On.
- Close and relaunch the console.
Step 2 – Configure Email Notification in ConfigMgr
This step is very important because you want to get an email when user requests for an application. Hence configuring email notification is required and you can refer my post on how to configure email notification in SCCM.
To Configure Email Notification :-
- Launch SCCM console.
- Navigate to Monitoring > Overview > Alerts > Subscriptions.
- Right click Subscriptions, click Configure Email Notification.
- Enable email notification for alerts. Specify either FQDN or IP Address of the SMTP server to send email alerts.
- Specify Sender address which is the email address from which alert emails are sent.
- On Test SMTP Connection window, enter the test email recipient and click Send test email.
- If you receive a test email, your configuration is correct. Proceed to Step 3.
Step 3 – Deploy an Application to User Collection
We will now deploy an application to a user collection. As an example, I will be deploying the Putty application to a user collection. Right click the application and click Deploy. Click Browse and select a User Collection.
Under Deployment Settings select the following.
- Action – Install
- Purpose – Available
- Allow end users to attempt to repair this application – Enable this option if you want the user to repair the application right from software center. To know how this feature works, read this post.
- An administrator must approve a request for this application on the device – Enable this option because this is required to test the email approval feature. Notice that there is a textbox where you can specify email addresses. If you are specifying multiple email addresses, add ; after each email address. When user requests the application via software center, an application request email goes to all the email addresses that you specify here.
If you need to set the application available time you can do it here. Else click Next.
Click Next.
On the remaining pages, click Next. Finally on Completion page click Close.
Step 4 – Testing the Request and Approval Feature
The user now opens Software Center and requests the application. The user can add some details as to why the application is required and click Request button.
Once the user requests application, a message is displayed, Your request has been submitted. User has an option to cancel request in-case the application is not required.
Once you receive the email, you can now approve the application request. To approve the request, click Approve link. The email that you receive looks similar to below one.
Hi there,
“User” wants to install PuTTY on the device titled User Device. Please click one of the buttons below to approve or deny this request.
Approve Deny
Note: these links only work when connected to your internal network.
When you click Approve, a link opens in the default browser. You can also right click Approve and copy the link and open it in different browser. When you do that you would see “Success! Configuration Manager received and processed your request to approve this application.
When the admin approves the request, the application is installed automatically on user’s machine. The user will now see the application installed.
Hi,
wich role need the Admin to approve an application?
I need this for a non SCCM Admin to approve a specific Application.
Is there any place where we can see all the application deployments which are marked as “Approval Required” and the e-mail ID entered at the time of deployment creation under “Approver’s E-mail Box”
Hi Prajwal, regarding to the note under Step 3, there is a possibility to modify rcpt addresses in Monitoring > Alerts > Subscriptions
Good morning,
First off I’d like to thank you for all the ” how to ” guides you’ve provided over the years. I have used them alot in our setup. We are currently using version 1906 ( including the hotfixes ) of SCCM. I have this process setup and working up to the approval point. I should mention I recently removed the application catalogue roles as I see they will not be supported soon. I get the email that asks to approve or deny but when I click on the link, it’s like the website doesn’t exist. I’d also like to post a screenshot but don’t see where I can do that here. Thanks in advance.
Can you post it in community forums.
I sure can. Doing that as we speak. Thanks for replying so quickly!!
Done!!
Good morning, we have been able to figure out what the issue was. I read in one of your other posts about IIS and having the proper certificate for HTTPS. We installed that and now we have success. Thank you for all your guides and have a great day!!
Hello,
I have the same problem, when I try to approve it using the email, the page sends an error:
“https://servername.domain/AdminService/v1.0/UserApplicationRequest/AdminService.ApproveRequest(Guid=’856B00BE-B3B5-432E-8FAD-2F93A5906A13′)
Turn on TLS 1.0, TLS 1.1, and TLS 1.2 in Advanced settings and try connecting to again. If this error persists, it is possible that this site uses an unsupported protocol or cipher suite such as RC4 which is not considered secure. Please contact your site administrator.”
Can you Help me, please?
IN our Environment we ave deployed couple of Application that require Admin Approval to be Installed. Now we are planning to Change the Process so that users can see the Install option in stead of Request. Can i Uncheck the box from deployment properties or do i need to perform extra steps?
Is there a way to check when the user requested application from appstore from SCCM console. Also is there any log where we can track the request.
Hello Prajwal,
My company is using Different port for client communication and using only HTTP authentication, when I am clicking on approve it shows me error, have checked the SMS Provider binding and 443 is set to ‘not selected’.
How to configure that?
“Note – In my testing i found that once you specify email addresses and deploy the application, you cannot change or modify them later. Neither in application properties nor deployment settings. So ensure that you specify correct email address.”
You can change them by editing the subscriptions in Monitoring/Overview/Alerts/Subscriptions
Is there a way we can fetch the E-mail address specified at the time of deployment under “Approver’s E-mail?
I’m getting as far as configured the deployment to the user group, but don’t see the app showing up in the Software Center. Any thoughts on what I can check or logs I can check to see where the process is breaking down? Primary site is 1810 and looks like my client is up to date.
I having the same issue. software not displayed in software center, when deploy it to device collection it’s appear, the app set to install for user.
Hi, Can we change somewhere language or text message on approve email?
Where getting this message when trying to approve the request:
Can’t connect securely to this page – This might because the site uses outdated or unsate TLS security settings. If this keeps happening, try contaction the website’s owner.
that solved the issue 🙂
There where no certificate.
thank you so much
Need Credential to access web!!!
Correctly ?
Hello, Prajwal Desai. Thanks for this article. Is it posible to change default request text? Thank you.
“Hi there,
“User” wants to install PuTTY on the device titled User Device. Please click one of the buttons below to approve or deny this request.
Approve Deny
Note: these links only work when connected to your internal network.”
Nope, I guess that cannot be done, i haven’t seen that option yet. But let me recheck..
I was also wondering if the default request email wording can be changed with CM 2203 or greater?