## TL;DR
Trace the request stage by stage before you change the package, because workflow error covers approver lookup, policy evaluation and assignment in one vague label. Open a failed request, note the stage it reached, and check whether the approver named by the policy actually resolves for that requester, especially when the policy uses manager approval and the requester has no manager recorded. Fix the approver source or add a fallback approver stage, then submit a fresh test request and walk it through approval to assignment.

```text
Entra ID entitlement management access package approval failed with workflow error
```

## Use this when
- Access package requests fail or sit in an error state before delivery.
- Requests from one department fail while others complete.
- The requester gets a workflow error with no actionable detail.

## Not for this skill when
- The package assigns access that is wrong. Redesign the package resources instead of the approval flow.
- Users cannot find the package in the access portal. That is a catalog visibility issue.

## Steps
1. Open the failed request in entitlement management and record its current stage, the policy it used and the exact status text shown to the admin. Verify: the failing stage is named rather than guessed.
2. Open the access package policy and list its approval stages, approver types and fallback settings, checking whether manager approval is required and whether a fallback exists. Verify: the approval design is documented for this package.
3. For a failed requester, open their Entra profile and confirm the manager attribute is present and points at an active user, or confirm a sponsor for external users. Verify: the approver source for the sampled requester resolves or its absence is confirmed.
4. Check the requester is in the policy scope for who can request, and that any connected organization or group membership the policy requires still exists. Verify: scope membership is confirmed for the failing population.
5. Repair the policy by adding a fallback approver group or correcting the approver source data, keeping the original approver as first stage so normal requests are unchanged. Verify: the updated policy saves and shows the fallback stage.
6. Submit a test request as or for an affected user, approve it as the resolved approver, and confirm the assignment appears on the user within the expected window. Verify: the test request completes end to end with access assigned.
7. Reprocess or ask requesters to resubmit the failed requests, track them to delivery, and note the policy change in the review evidence for this package. Verify: previously failed requests reach delivered state or are resubmitted cleanly.
8. Create a daily check during the request window that lists access package requests sitting in an error state, and assign it to the package owner so broken requests are repaired while requesters still remember submitting them. Verify: the check runs daily and an errored test request appears on it.

## Why it happens
Entitlement management chains several lookups into one request: the requester scope, the approver for each stage, and the resource assignment at the end. The workflow label appears when any link breaks, and manager based approval is the most fragile link because it depends on directory data quality for every individual requester. That is why failures cluster by department or user type. A fallback approver stage makes the flow resilient without weakening it, since the primary approver still acts whenever they can be resolved.

## Variants and edge cases

### access package request stuck pending approval with no approver
The orphan request phrasing. The approver failed to resolve; check the requester manager or sponsor data first.

### Entra entitlement workflow error on approval stage
The stage phrasing. Open the request details to see which stage errored before editing the package.

### external user access package approval fails
The guest phrasing. Guests rely on sponsor based approval, so a missing sponsor produces the same workflow error.

Edge cases to check before closing the review cycle:
- Changing a policy does not repair requests already in flight. Expect to cancel and resubmit the broken ones.
- Multi-stage approvals fail at the stage whose approver left. Delegation and fallback settings differ per stage.
- Assignment can lag approval by minutes. Confirm delivery in the user assignments view before calling it failed.

Compatibility: Microsoft Entra ID entitlement management, access packages and approval policies, Microsoft Graph entitlement management endpoints.

## Provenance

Resolved from the public thread: https://vectle.com/posts/pst_v-6aLxuDb3oVyS2PzjgS8A