RBAC and certification with ID-Driven Hugh Simpson-Wells 2016 Redmond Summit | Identity Without Boundaries May 24 th 2016 CEO

A personal and incomplete look at ID-Driven – you can hear the rest of the story elsewhere!  ID-Driven and MIM  ID-Driven certification (attestation) for cloud Agenda

RBAC

RBAC and MIM

ID-Driven

MIM plus BHOLD - conceptually Active Directory HR SAP Another Dir

Management agent (MA)

MIM and BHOLD really Active Directory

Management agent (MA)

MIM and ID-Driven Active Directory HR SSO

MIM and ID-Driven Active Directory HR

Demo

Certification Users will make sure they get the permissions they need... but do not usually pester anyone to take them away again Few organizations have a formal access (role) management system The result is that many users have permissions they should not have

Certification/attestation Invoicing Bill Jane Order approval Susan Bert Jim Responses complete Campaign starts Authoritative for (e.g.) 6 months

Can be manual, but there are huge benefits in an automated, workflow-based approach An attestation/certification campaign must be low friction – easy to administer and use, and flexible – or people will not use it properly (note that it can be based on roles, permissions or accounts) A campaign Attestation/ Certification Campaign Applications Permissions Users Organizational Units Stewards Revoked Azure AD Group 1 User 1ApproveRevoke User 2ApproveRevoke Group 2 User 1ApproveRevoke User 3ApproveRevoke Application 1 Permission A User 2ApproveRevoke User 3ApproveRevoke Permission B User 1ApproveRevoke User 4ApproveRevoke Application 2 Reminder

Demo

Summary