Entitle for Slack

Entitle can be added as an app on Slack. This will require your Admin to configure the integration between Entitle and Slack through the Entitle admin console. Following the integration, the Entitle app is added to the list of available apps in your organization, but you will still need to add it to your Apps list. The interaction in the Entitle App is through "/" (slash) commands, as described below.

Integrate Slack with Entitle

ℹ️
Only Entitle admins can configure the integration with Slack.

Log in to Entitle and navigate to the Org settings page.
Locate the Slack app and click Connect.
Grant your consent in the Slack portal.

The Slack app is now integrated with Entitle.

Identity verification

To strengthen identity verification within the Entitle and Slack integration, new users must authenticate with Entitle one time from within Slack before making access requests through the /entitle command.

This enables Entitle to verify a Slack user's identity, mitigating a vulnerability that could occur if unverified email addresses were configured in Slack workspaces. For security reasons, this prompt cannot be disabled.

Connect a Slack channel to Entitle

For Entitle to send approval requests and notifications to a Slack channel, the Entitle bot must be a member of that channel. To add the bot to a channel:

Open the Slack channel (public or private) where approval requests should appear.
In the message field, enter:

/invite @Entitle
Press Enter.

Once invited, the Entitle bot can post approval requests and notifications in the channel.

You can also add the Entitle bot using Slack’s channel member management controls.

Slack channel approvals and notifications

Entitle supports routing access approval requests to Slack channels. When a request is sent to a channel, any channel member can approve or decline the request directly from Slack. Channel-based approvals enable teams to collaborate on approval decisions without assigning a specific individual approver.

When an approval workflow is configured to send notifications to a Slack channel, access requests generate notification messages directly in that channel.

View request behavior for channel-based approvals

When approval requests are routed to a Slack channel, the behavior of the View request option depends on the user's status in Entitle.

Authorized Entitle user: The user exists in Entitle and has permission to view the request. Selecting View request opens the request details in the Entitle web app.
Known user without request access: The user exists in Entitle and can approve or decline the request from Slack, but is not explicitly authorized to view the request in Entitle. In this case, selecting View request is blocked for security reasons.
Unknown (unregistered) user: The user is a member of the Slack channel but does not exist in Entitle. Selecting View request returns an unauthorized error.

This behavior affects only the View request option. The Approve and Decline actions are still available. If a user is not logged in or registered, they are prompted to authenticate before their action can be applied.

Permission request flow in Slack

ℹ️
For instructions on how to create a new permission request on Slack, see the Entitle for Slack end-user guide.

Once an access request is submitted, the approver will receive a message via Slack regarding the summary of the request, including the duration, justification, and linked ticket, if available.
Once the permission is approved, another message is displayed to the end-user, indicating that the request has been approved.

End-user log in using ephemeral credentials

ℹ️

Some services, such as MongoDB, do not support SSO or may be not configured to work with the organization IdP. In such cases, the end-user is required to log in directly to the service using ephemeral credentials received through Slack.

For details, see the Entitle for Slack end-user guide.