01 A new starter’s first week
Maria joins the design team. Instead of a list of things to email IT about, she opens Catalog and requests the four applications her team uses. Two have no approval step and are granted immediately. Two go to her manager, who approves them the same afternoon from a link in an email. By the next morning Intune has installed everything on her laptop.
02 A licensed product with a real gatekeeper
The organization has a limited number of licences for a design application, and the design lead owns them. The application is published so only members of the design and marketing groups can see it, and every request goes to the requester’s manager and then to the design lead. When someone outside those teams needs it, the request never gets made by accident.
03 A device that needs the software, not the person
An engineer needs a CAD package on the workstation in the lab, not on their laptop. They request it, pick the lab machine from their own managed devices, and the approval carries that device with it. The install lands where it was meant to.
04 A joiner request that outlives the joiner
Someone requests access to two applications and leaves the company a week later, while the requests are still with their manager. The directory clean-up removes them from Catalog, closes both requests, and tells the approvers the requests are closed and need no action.
05 A group that four people have to agree on
Joining the group that grants access to the finance reporting system is not a casual request. It is published so only finance and the leadership team can see it, and its chain has four steps: the requester’s manager, their manager’s manager, the group’s moderator in finance, then a named person from security. The same catalog also holds a group anyone may join with no approval at all. Neither is a special case.
06 A reorganization nobody has to tell Catalog about
Two departments merge and forty people get a new manager. Nothing in Catalog is touched. Every step not yet reached goes to the new manager, because the requester’s manager is read from the directory as each step comes up, not stored as a list somewhere.
07 Being asked to grant tenant-wide consent
An IT director is asked to approve a new vendor’s access to their Microsoft tenant — usually the point at which an evaluation slows down for a week. The setup screen lists all six permissions with a sentence each explaining why they are needed, and five of them are read-only. The director can see that the product cannot deploy software, change device policy, create accounts, or read mail before granting anything.