«Another administrator must approve this change.» (second_administrator_required)

Symptom

A change waits or is refused with «Another administrator must approve this change.», or, in privileged access, a message that it was sent for approval and a second administrator must approve it under PAM › Dual control. The API answers 403 second_administrator_required or 202 with the pending request.

Cause

The change is under the four-eyes principle:

• authenticator resets with «Require approval from a second administrator» on (and switching that option off);
• changes protected by privileged access «Dual control»;
• operations that are always four-eyes: setting the break-glass group, registering the escrow key, releasing a legal hold.

Fix

1. Ask another administrator (neither the requester nor the person concerned) to open the pending list:
   • resets: «Manage» › «Users» › «Authenticator resets» › «Approve»;
   • privileged access: «PAM» › «Dual control» › «Approve and apply».
2. The second administrator confirms with a recent confirmation.

Resets wait one hour; privileged access changes wait 24 hours. Then they expire and must be requested again.

When to escalate

If no other administrator is available, the change cannot be made. In an emergency, contact your provider; do not try to bypass the control.