Per Cisco’s Service Access Policy, only users who work for an entitled party on a service contract may consume those service entitlements. Cisco’s access automation and agents will deny users requesting access to a service contract when they are not an entitled party on the contract. However, there may be circumstances when the contract’s entitled party, the partner or end customer, requires a third-party to consume their service entitlements.
A third-party is a company that is not listed on the contract. The third-party may be either a company hired by the end customer company to manage support on their network, a service partner that the entitled services partner has outsourced their customer support operations to temporarily, or a company that has merged with or was acquired by the entitled company. In such situations, the third-party company is neither the end customer company listed as the install-site on a contract nor the partner who sold the contract (contract bill-to company).
Email domain matching rules may be enabled to override denials by Cisco when users from a third-party request access to a contract. Company name matching (among other criteria) is used by Cisco automation as a basis to grant and deny access. A SAMT Admin may enable automatic approvals and/or reviews from users that match specific company email domain address(es) and/or enable automatic denial of contract association requests from users whose email domains in their Cisco profiles do not match the set auto-approve company email domain address(es).
• Email domain settings are not available for requests for “software download access only” enabled on partner branded contracts.
• Email domain settings are not available for end customer access requests to Cisco branded service contracts (install-at entitled) that contain multiple end customers. All Cisco branded service contracts must only contain one end customer entity. Email domain settings for these contracts are available for user access at the bill-to level only which provides access to all service lines on the contract and only available for users working for or on behalf of the bill-to company (usually partner users).
The following tutorial explains how to create and enable email domain settings to auto-approve, review, and deny access depending on users’ email domains.
Create & Enable Email Domain Settings:
Step 1. When in SAMT, click the arrow tab >> to view the “Lock/Unlock” tab. When visible, click the “Lock/Unlock” tab. All contracts you manage are listed on one or multiple pages. Note the column highlighted in yellow in the screenshot below. The column is labeled “Email Domain Matching Enabled”. By default, email domain matching is not enabled. Ensure that the contract has not been locked from Cisco by checking the “Locked” column highlighted in red in the screenshot. If a contract is locked from Cisco (a “Yes” in the “Locked” column), email domain rules will not be effective. Unlock the contract before creating or enabling email domain rules. Refer to the tutorial for how to unlock and lock a contract in SAMT, if needed.
Step 2. Find the contract from the list of contracts (A) and click the “Add” hyperlink that appears in the “Email Domain Matching Enabled” column and row of the contract selected (B).
Step 3. In the next “Contract Email Domain Settings” screen, choose the company to setup the email domain criteria (1).
Step 4. Change the ‘Email Domain Validation for Access Automation’ dropdown from Disable to Enable (2) and the rest of the page becomes selectable/fillable.
Step 5. Click the first checkbox and enter email domain(s) that a user must have in their Cisco profile for Cisco to AUTO APPROVE (3). This option should be chosen when all users with the email domain need support access to the contract. You may enter up to 25 email domains separated by commas. Public email domains are not permitted. When the first checkbox is checked, all users requesting access to the contract with matching email domains in their Cisco profile will be granted access and any requests from users whose domains do not match will be sent to your SAMT inbox for review. Include your own company’s email domain to ensure your users will be auto-approved as well. Otherwise, the user requests from your company will be sent to you for review.
Step 6. If you do not want all users from a specific email domain to be granted access when requested, click the second checkbox to enter the email domain into the second REVIEW text box (4). This sends all requests from users matching this email domain to your SAMT inbox for review. All requests from users with domains that do not match the AUTO APPROVE domains (first textbox) and/or the REVIEW domains when the REVIEW box (second checkbox) is checked (whether domains are listed in the textbox or not) are DENIED. Note: If your own company’s email domain is not listed in the auto-approve area or review area and both are enabled, your company users will be denied access. If auto-approve checkbox is not enabled, but the second checkbox is enabled and your company domain is not listed, your company users will be denied access. If only the first checkbox is enabled (checked), all requests not matching the email domain will be sent for review.
You do not need to set both auto approve and review/ deny. You may choose to set-up and enable one or the other, or both.
Step 7. Once entries are complete, click save. The email settings take effect immediately upon saving. If you want to save the rules but not enable them, set the “Enable Domain Validation for Access Automation” to Disable (5). When disabled, the settings are saved in SAMT but are not enforced. Saving the email domain rules, but not enabling them, provides time for further review of the settings. After setting to disable, the checkboxes and textboxes are grayed out. Click Save.
Step 8. SAMT returns to the “Lock/Unlock” tab after the domain settings are saved. Take note of the column “Email Domain Matching Enabled” is updated. When domain settings are enabled, that contract’s row displays “Yes” with an “Edit” link to adjust settings when needed. When domain settings are disabled, the column displays “No” with an “Edit” link to adjust settings and enable when desired.
Step 9. To enable or disable existing email match settings (with no edits to the current rules), enter a contract number in the text box after “Enter Contract Number” or check the box of the contract(s) in the displayed list and choose “Enable” or “Disable” in the action drop-down. Click Submit.
Questions about email domain settings may be emailed to cx_ent_ops_escalation@cisco.com.