Approval step
An approval step pauses automation until a named person says yes. It matters for write actions such as isolating a host or disabling an account. Check who can approve, where the request arrives, what is logged and whether approval is set per action or per whole playbook.
What Approval step means
Some platforms ship the step as a built-in gate. Others leave the author to build it from an email or a chat message. The second kind works, and it moves the control from the product to your design.
In an audit, the log of the request, the approver and the time is the evidence. Ask to see one.
Approval step in Microsoft Sentinel's own words
Microsoft's migration guide maps Splunk prompts to a Send approval email action in Logic Apps and says high-impact automations should have human input. Microsoft Sentinel documentation, read 2026-11-03