Reviewer Training Manual

Agenda SecureIT Benefits Reviewers Responsibilities Review Phases User Validation Training Modules Definitions

SecureIT Benefits Provides a streamlined and automated process for reviewing access, which enables the following: Security of Microsoft’s financial data through least privilege access Time savings for control owners and reviewers through automation of manual processes Increased accuracy due to automated checks, reporting and oversight Reduced manual monitoring efforts Reduced control deficiencies Centralized evidence retention to support audits

Reviewers Responsibilities Kick-off Upload Validate Remove Sign-off Site Admin Start new review Manage Review Close review Control Owners N/A Upload list of users Review system accounts Remove invalid users Complete sign-off Reviewers Review assigned users SCLOs Access Type Site Admin Full control to all Control Owners Assigned workspaces – upload workbook, review users Reviewers Review assigned users SCLOs Assigned workspaces – sign-off only Auditor Read-only to all

Review Phases Kickoff Upload Accuracy Sign-Off Validate Remove Site Admin kicks off the process Control Owner & SCLO sign-off on completion of review Control Owner uploads list of user and notifies Reviewer Completeness and Accuracy Signoff by the CO and SCLO of the uploaded user list Control Owner removes invalid user Reviewers validate access

User Validation Overview As a Reviewer you will receive an email from SecureIT when the Control Owner has finished uploading users. Open the link in the email which will direct you to the SecureIT VNext. A pop up message may appear if you have users to review in another applications. In the main menu, click the icon on the left to activate the validation page. Select the application you’re wanting to review from the “Select Application” dropdown. Select the user(s) you’re needing to validate by checking the boxes to the left of the grid. For each user, click the blue “ACTION” button to the right and update the status with either “Retain Access”, “Revoke Access”, or “Not Mine”. See definitions slide for explanation. The tool should auto save after every action you select. Optional: Add a business justification to explain the action taken. (Note: The business justification is found under the “ACTION” submenu under “Update Justification”).

User Validation Dashboard View Below diagrams the main options you’ll have as a reviewer. While using this tool, explore these links as there are many new features to help with your review process. Select Review Name Select Application Review Timer Countdown Tenant Selection Expanded Menu Option Dashboard Validate Users Email Secure IT Support Feedback / Chat with BOT Reports User status graph for the current review. Goal is to complete all pending

User Validation View Benefits Progress of App Progress of Total Review Holistic view of reviews assigned to you Toggle between reviews and applications Saves your preference settings in the tool Validate users with single or bulk feature Export user list to excel or csv Progress of App Progress of Total Review Action Menu Perform user validation Add justification View history of selected user(s) Options Menu Export data Add / Remove Columns

User Validation Reviewing Access Getting To Validate Users Page Visit your https://secureit.microsoft.com/ Pop up message may appear if you have users to review in another application. Select the application you’re wanting to review from the “Select Application” dropdown.   Important Note: If the application you’re looking for is not in the dropdown, your Control Owner hasn’t enable the review. Validate Users Page Select the user(s) you’re needing to validate by checking the boxes on the left of the grid. You can also do a bulk validation by checking more than one boxes. Once ready, click the blue “Action” button to activate your options. Validate the user by selecting one of the following: 1 2 Retain Access - The user still needs access. Revoke Access - The user no longer needs access. Not Mine - The user is listed under the wrong Reviewer and should be reassigned by the Control Owner.  Indicate the appropriate Reviewer by adding details to the “Justification” field.  Please note this field is required for any users marked as “Not Mine.”   Quick Tip 1: As a Reviewer, you may be listed on multiple applications to perform the validation review. Please check the “Select Review” and “Select Application” drop-down menus if you are listed in another workspace to fully complete user validation. Quick Tip 2: By default, the tool is set to display 10 users per page. Ensure you validate all users by completing all the pages in your review

Definitions Retain Access - The user still needs access Revoke Access - The user no longer needs access Not Mine - The user is listed under the wrong Reviewer and should be reassigned by the Control Owner Add/Update Justification - The reason for the action taken - this is required for any Not Mine users