Updated 4 November 2026 by Simon Mestdagh, founder of Caspian.

Key takeaways

• Under 50 people, few requests: a Slack Workflow Builder form, which leaves the account work with IT.
• Access already runs through Okta or Entra groups: a service desk agent such as Siit or Console.
• Want the account created after approval: an access tool such as AccessOwl, Lumos or Caspian.
• AccessOwl lists $4.50 per user per month with a $250 minimum (checked 4 Nov 2026).
• Caspian handles requests in Slack, Teams and Google Chat; Act is €10 per active user per month.

Access requests in Slack, Microsoft Teams or Google Chat work in one of three ways: a dedicated access tool that provisions the account after approval, a service desk agent that routes the approval and leaves provisioning to your identity provider, or a home-made Slack workflow that only collects the ask. The first closes the loop. The second suits teams that already run Okta or Entra groups for everything. The third costs nothing and leaves the work with IT.

Caspian publishes this article and sells a product in this space: Caspian, the IT automation platform for scale-ups. We say where another tool fits better. Facts and prices were checked on 4 November 2026.

What should an access request in chat do?

Five steps, in order:

1. The employee asks in the chat tool they already use.
2. A rule decides routine requests without a person.
3. The app owner decides the rest, in the same chat, in one click.
4. Something actually creates the account: SCIM, an API, a browser, or a person with a task.
5. The employee hears back, and the whole chain is logged for audits (SOC 2 CC6.2, ISO 27001 A.5.18).

A Slack form that posts "Jan wants Figma" into #it-requests does step 1 only. Most of the work for a one-person IT team sits in steps 3 and 4.

What are the ways to handle access requests in chat?

There are four: a Slack Workflow Builder form, an access tool such as AccessOwl or Caspian, a service desk agent such as Siit or Console, and an identity governance suite such as Entra ID Governance. Only the access tool creates the account itself; the form leaves that work with IT.

Approach	Where employees ask	Who approves	Who creates the account	Typical buyer
Slack Workflow Builder form	Slack	IT, by hand	IT, by hand	Under 50 people, few requests
Access tool (AccessOwl, Lumos, Opal, ConductorOne, Caspian)	Slack, Teams, web; some add CLI or Google Chat	Rules, then app owner	The tool (SCIM, API, browser) or a task	30 to 5,000 people
Service desk agent (Siit, Console)	Slack, Teams	Rules, then approver	Your identity provider's groups	Teams that run access through IdP groups
Identity governance suite (Entra ID Governance, SailPoint)	Portal, Teams	Policy	The IdP or connectors	Regulated enterprise

What do access request tools cost?

Public prices start at $4.50 per user per month for AccessOwl Basic, with a $250 monthly minimum. Lumos, Opal and ConductorOne quote per contract. Caspian's Act plan is €10 per active user per month excluding VAT, with seeing free. Each price carries the date it was checked.

Tool	Chat channels	Provisioning	Public price (checked)
AccessOwl	Slack, web	Service accounts and browser automation; API and SCIM where they fit	Basic $4.50, Growth $6.00 per user per month, $250 monthly minimum (pricing, 4 Nov 2026)
Lumos AppStore	AppStore, Slack, Teams, CLI, ITSM	SCIM, API, on-prem agent	No public price; AWS Marketplace listing from $27,000 per year as cited by AccessOwl, Sept 2026
Opal	Opal UI, Slack, Teams	Connectors to cloud, databases, SaaS	Custom quote (Flamingo roundup, May 2026)
ConductorOne	Slack, web	Connectors	Custom quote (same source, May 2026)
Siit	Slack, Teams	Through your IdP	No public price found
Microsoft Entra ID Governance	Portal, Teams	Entra	$7 per user per month add-on (Flamingo roundup, May 2026)
Caspian	Slack, Microsoft Teams, Google Chat, web	SCIM, then API, then browser automation with approval, then a task	See free; Act €10 per active user per month excl. VAT, 30 days free, no card (pricing, 4 Nov 2026)

When to pick each access request tool

AccessOwl is built for Slack-first companies from about 30 employees and publishes its prices. If your stack is Google Workspace and you want requests and offboarding in one Slack app, it is a straightforward pick.

Lumos fits companies of 200 people and up on Okta that want time-bound access and an AI agent approving routine requests. Expect a sales process.

Opal and ConductorOne fit engineering-heavy teams that need time-bound access to AWS roles, databases and GitHub, as well as SaaS seats.

Siit and Console fit teams that already manage access through identity provider groups and want an agent in Slack or Teams in front of them.

Caspian fits companies with small IT teams that want the request, the approval and the account change handled from the same place that shows every app, AI tool and laptop. Many tools in this list take a lot of configuring or a sales call before the first request; Caspian is self-serve and free to start. Compared with an access-only tool, the laptop is included: Caspian installs the app on the device too. It also grants access inside apps, such as Slack channels, GitHub teams and Google groups, and reaches apps without SCIM through auditable browser scripts. Compared with a service desk agent, Caspian makes the change in the app over SCIM, API or the browser instead of opening a ticket, and the price is public. If an app is not offered to the employee, Caspian suggests apps of the same category they can get now. Caspian is not an identity provider and needs Google Workspace, Microsoft Entra or Okta. See how access requests work in Caspian.

How does an access request flow in Caspian?

1. An employee asks the Caspian app in Slack, Microsoft Teams or Google Chat. Caspian shows an interactive confirmation; nothing is sent until the employee clicks.
2. If the access matrix sets the app to On request for the employee's group, Caspian approves at once.
3. If not, the app owner or the access granters for that app approve or deny in chat. The requester cannot approve their own request.
4. Caspian makes the change, reads the app back to confirm it, and notifies the requester.
5. Every step is logged.

What should you ask an access request vendor?

• Does a request end with an account, or with a ticket for IT?
• Which apps need SCIM, and does that force an enterprise plan on the app?
• Can a rule approve routine requests without a person?
• Can the requester approve their own request? (The answer should be no.)
• Is there a public price?

What does Caspian read, and with which rights?

Caspian reads metadata and settings, not content. It reads which apps exist, who has an account, which role that account has, and the state of each laptop. It does not read file contents, email bodies or chat messages. Connections are read-only by default; Caspian asks for write rights only for the steps you switch on, such as removing a leaver's account. Customer data is stored with AWS in the EU (Frankfurt). An independent pen test is planned, and ISO 27001 and SOC 2 are in progress.

Simon Mestdagh, founder of Caspian, wrote this page. We make Caspian, one of the tools discussed here.

FAQ

Can Slack handle access requests on its own? Slack Workflow Builder can collect a request and post it to a channel. It does not create the account or remove it later.

Do I need SCIM for access requests? No. SCIM is one way to create the account. Tools also use the app's API, browser automation or a task for a person.

Which tools work in Microsoft Teams? Lumos, Opal, Siit and Caspian list Teams support. AccessOwl lists Slack and web.

What does a Slack access request tool cost? Public prices run from $4.50 per user per month (AccessOwl Basic, $250 minimum) to quote-only enterprise contracts. Caspian's Act plan is €10 per active user per month excluding VAT, all their laptops included, 30 days free with no card.

Start for free. Self-serve, no card needed. Or add Caspian to Slack, Teams or Google Chat.

← All resources