[MUSIC]
Joe Castellanos: Hi, everyone. Thanks for tuning in. My name
is Joe Castellanos and I’m a Program Manager on the Azure
AD Identity Governance team.
Mamta Kumar: Hi. My name is Mamta Kumar and I’m also a
Program Manager on the same team.
Today, we’ll be talking about how users from other
organizations such as partners or customers can collaborate
with us in a secure and productive manner. We will show
you how to govern and manage access of these guest users
that work with their employees using Entitlement Management,
an Azure AD Premium feature.
Joe: In this scenario, I’m an IT admin at Graphic Design
Institute. Our organization works on many collaborative
projects with other organizations, such as Woodgrove Bank,
Contoso, and WholeMinds. As the IT admin, my topmost goal
is to secure our organization and it resources and manage
access that users from other organizations have in Graphic
Design Institute.
As the IT admin, I’m going to show you how you can set up
the external organizations to collaborate with. Let’s start
with the first organization, Woodgrove Bank. The main
contact we work with at Woodgrove Bank is Mamta Kumar.
Her email is mamtakumar@woodgrovebank.online.
Using this domain information, I can add the external
organization. Let’s do a walkthrough on how an IT admin
can set up an external organization as a connected
organization.
I’m going to jump into the Azure Portal and within Entitlement
Management, we have a new left nav item called connected
organizations. Within here, I can go ahead and add a new
one. And let’s go ahead and give it a name. So, let’s call it
Woodgrove Bank.
This represents all users from the Woodgrove Bank company.
Cool. Now, that we have a name and description, we can take
a look at directories and domains. Depending on the partner
or other organization that you’re working with, you can
search by their domain and Azure AD will look up and target
that domain as your connected organization.
So, in the first example, we have Woodgrove Bank. My contact
there is Mamta Kumar and her email is
mamtakumar@woodgrovebank.online. So, let me go ahead
and search by woodgrovebank.online. Here, the system will
look up and find that Woodgrove Bank is an Azure AD
directory and this will add all of the users from the Woodgrove
Bank directory in scope of this connected organization. Now,
as I mentioned, there’s multiple different organizations that I
may be collaborating with. Those organizations may be in
different shapes and sizes. So, one of the other companies
we mentioned was Contoso. My contact at Contoso is Mark.
Mark’s email is mark@df.totheclouddemo.com. So, let me
go ahead and search real quick by that domain.
Same thing. We are able to look up and find that this
domain is already connected with direct federation. So,
any user associated with this direct federation will fall
in scope of this connected org.
Lastly, we work with Hana, Hana from WholeMinds. Her
email is hana@wholeminds.org. So if I take that same domain
and search, we’ll find that Hana’s domain is found and she’ll
be able to authenticate using one-time passcode. So, it
doesn’t matter what size of organization the user’s coming
from, whether they have managed IT or don’t have IT at all,
you can still search by their domain and we will be able to
connect them. So, let’s go ahead and finish off and create
Woodgrove Bank.
Let’s add them.
So, after you add the directory and domain, the next thing
you get to do is add sponsors. Within connected organizations,
we now have two new roles—internal sponsors and external
sponsors. For internal sponsors, this represents the point of
contact you have within your own organization and external
sponsors are your point of contacts from your partner
organization. So, let’s go ahead and select an internal
sponsor here.
I’m going to go ahead and pick Alan.
And then for external sponsors, I’m going to go ahead and
pick Mamta, since she is my point of contact. I’ve already
invited Mamta via B2B. So, let me search her. So, her B2B
account already exists. So, mamtakumar@woodgrovebank.online.
Great. So now, I can review and create and we’re going to go
ahead and create this new connected organization.
Awesome. Now that we’ve created this new connected
organization, what can we do with it? We’re now able to
leverage these connected organizations when you create
policies within access packages. So, I’m going to go ahead
and flip over to an access package that we’ve already
created and create a new policy.
For this policy, let’s go ahead and scope it to Woodgrove
Bank. Alright.
So, traditionally, you’ve been able to scope access packages
to users in your directory, but now you can scope them to
users not in your directory. And you can choose the specific
connected orgs. So in this example, I can now choose
Woodgrove bank. This allows any user from the Woodgrove
Bank directory to view this access package and request it.
Since these users are coming from another organization,
I’m going to require approval.
And since the Graphic Design Institute likely doesn’t know
who from Woodgrove Bank will need access, I can actually
choose which sponsor I want to be the approver. So, in
this example, since I likely don’t know the folks from
Woodgrove Bank, I’m going to choose the external sponsor
to be the approver. In case there is a request that comes
through with no sponsor, I can go ahead and choose a
fallback. So, we can ensure that there’s always an approver
in place. So in this case, I’m going to do Alan for myself
in this example.
Awesome. Let’s go ahead and enable this. And the rest of
these settings are the same settings that we’ve enabled
within access packages previously. So, I’m going to go
ahead and create this policy.
Mamta: As the external sponsor at Graphic Design
Institute, Joe has listed me as the approver for requests
submitted by my Woodgrove Bank employees.
Looking at the pending approvals, I see that there is a
request that my Woodgrove Bank employees have made.
I see that Bob from my company and Nadine from my
company have put in requests.
So, let’s look at Bob’s request details. These look good, so
I’m going to approve.
Thanks for joining us to learn about collaborating with any
organization, whether or not the have an identity provider.
To learn more, check out our other videos.
[MUSIC]