If you are not familiar with Entitlement management, read this first.

Azure AD Entitlement Management

Hi all, Today’s post I will be discovering possibilities with Entitlement Management from Azure AD. First you have to understand that this solution isn’t a complete Identity and Access Management product (IAM) If you are looking for these, please see Identity Governance Solutions | One Identity or Lifecycle Management and App Provisioning Software | Okta

Microsoft keeps evolving Azure AD Entitlement management solution, here is a feature added previously.

Multi-stage access review (preview)

Microsoft introduced a feature to allow Multi-stage Access reviews. In this post I will cover what the feature is about. So why and what is needed? First You need a valid Azure AD Premium (P2) license for each person, other than Global administrators or User administrators, who will create or do access reviews. This feature

And there is again a new feature added, let us see what it is.

Automatic assignment policy

You can now create a Dynamic query for any attribute, the interface is identical to other Dynamic group interfaces.

If you want to learn more on Dynamic groups and the possible use cases, read this one.

Azure Dynamic Groups and how to use Extended attribute.

I wondered how to automagically add users to an Azure AD group with after their mailboxes have been migrated to the Cloud thru an Exchange Hybrid (Classic or Modern) And I figured out this one. Users get always populated with TargetAddress attribute when Mailbox migration has been finalized. Quick recap what is TargetAddress and how

Once you have added the rule, you can create an assignment.

And you can choose custom extensions to be used.

Custom extensions can be Logic apps that you have created and want to be initiated when policy kicks in.

Trigger custom Logic Apps with Azure AD entitlement management - Microsoft Entra

Learn how to configure and use custom Logic Apps in Azure Active Directory entitlement management.

Then you will give it a name and description. Once done hit create!

Now you have a Dynamic query based policy that will assign you defined assignments. Easy as that!

Microsoft Graph

You can also use Graph for the following actions.

Why to use Entitlement Management?

Some of the scenarios could be the following:

  • Access control for a variety of resources, such as software, SharePoint Online sites, already-existing Azure AD groups and Teams, and groups deployed to on-premises AD.
  • Using a combination of policies to manage access so that both rules (such as granting access to everyone in a department) and exceptions (such as employees in other departments who require the same access) may be reviewed and deleted as necessary on a regular basis
  • By using custom extensions for entitlement management, which launch workflows when users gain or lose assignments, duties across Microsoft and third-party applications are further automated.

Archives