Self Service Group Management (SSGM) TechReady 18 9/20/2018 Module: Azure Active Directory 1 Self Service Group Management (SSGM) EMS Partner Bootcamp © 2014 Microsoft Corporation. All rights reserved. Microsoft, Windows, and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries. The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

Self Service Group Management SSGM By using the self-service group management features, the day-to-day control of group membership can be delegated to people in the business who understand the business context for that membership. Features include: Self-service group management for security groups Security group membership requests and approvals Application access management using user-managed security groups Benefits Reduced Administrative costs for managing groups Increased end user productivity in setting up groups for collaboration

Demo Self Service Group Management (SSGM) TechReady 18 9/20/2018 Demo Self Service Group Management (SSGM) End user experience signing up for Group membership Admin Experience setting up static and dynamic groups Configuring Groups for license, feature and application assignment © 2014 Microsoft Corporation. All rights reserved. Microsoft, Windows, and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries. The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

Self Service Group Management SSGM The SSGM Access Panel already provides users with single-sign on to SaaS applications. We've added tabs on the Access Panel where users can now see, create and manage groups.

Self Service Group Management SSGM Configure the service group management by clicking on the groups tab. By default this shows all the security groups in your Windows Azure AD.

Self Service Group Management SSGM Create a group tile in the upper left of the Access Panel. To create the group, just enter the display name that you want the group to have. You can optionally enter a description to help others in your organization understand how the group will be used or who the members will be.

Self Service Group Management SSGM Once the group is created, you'll see it on the groups tab. To add members to the group, click the add members tile, then choose members for the group in the Add members dialog

Self Service Group Management SSGM TechReady 18 9/20/2018 Self Service Group Management SSGM Assigning application access to a group One of the key features of Windows Azure AD is enable administrators to manage access to SaaS applications. With Windows Azure AD Premium, global administrator can assign application access to group. And since groups created by end users are stored in Windows Azure AD just like any other security group, these user- created groups can be seen by administrators in the Windows Azure Management Portal, and can be used like any other security group, such as to control access to an application or SharePoint site. © 2014 Microsoft Corporation. All rights reserved. Microsoft, Windows, and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries. The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

Self Service Group Management SSGM TechReady 18 9/20/2018 Self Service Group Management SSGM Selecting an application Using groups to assign access to applications simplifies access administration. Group membership can be managed in a single place, and used to assign access to all the applications or other resources to which that group needs access. In particular, the global administrator no longer needs to be involved each time someone needs access to an application: the user can request to join a group that has been assigned access to the application, and if the group owner approves, then the user is assigned access automatically. © 2014 Microsoft Corporation. All rights reserved. Microsoft, Windows, and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries. The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

Self Service Group Management SSGM TechReady 18 9/20/2018 Self Service Group Management SSGM Assigning members of a group access to an application Figure shows Admin assigning access for the Box application to the Sales group created application owner. Since the application owner manages the membership of the Sales group, the application owner can now assign or revoke access to the Box application without requiring ongoing assistance from the Admin. © 2014 Microsoft Corporation. All rights reserved. Microsoft, Windows, and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries. The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

Self Service Group Management SSGM TechReady 18 9/20/2018 Self Service Group Management SSGM Requests and approvals for group membership SSGM also enables users to request membership in groups by clicking on the gear icon on the group and clicking join. Figure shows another end user, requesting membership in A\the application owners Sales group. © 2014 Microsoft Corporation. All rights reserved. Microsoft, Windows, and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries. The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

Self Service Group Management SSGM TechReady 18 9/20/2018 Self Service Group Management SSGM Approving a request The administrator of the group can see requests to join the group on the approvals tab of the Access Panel, and can approve the request by clicking the approve button below the list of request. Figure shows application owner approving end users request. © 2014 Microsoft Corporation. All rights reserved. Microsoft, Windows, and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries. The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

Self Service Group Management SSGM TechReady 18 9/20/2018 Self Service Group Management SSGM Box application is visible on the Access Panel Once a user is approved as a member of the group, the user has access to all the resources which are assigned to the group. For example, if the group is assigned access to a particular SaaS application, the user will see the tile for that SaaS application on their Access Panel, and can click on that tile to get access to the application. Figure shows what the end user now has access to the Box application. © 2014 Microsoft Corporation. All rights reserved. Microsoft, Windows, and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries. The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

Dynamic Security Groups Membership is based using reg expression logic https://msdn.microsoft.com/en-us/library/azure/dn913807.aspx 

Dynamic Security Group Advanced Rules