[MUSIC]
Hana Kim: Hi. My name is Hana Kim and I am a Program
Manager in the Azure AD Engineering Identity Governance
team.
Mamta Kumar: Hi. My name is Mamta Kumar and I’m also
a Program Manager in the same team.
Hana: Today, we’ll be talking about how to delegate access
governance for both employees and business guests across
Office groups, SharePoint sites, and apps to different
departments using Entitlement Management, an Azure AD
Premium feature.
In this, I’ll be the IT admin for Woodgrove Bank. As the IT
admin, I have a point of contact in each department:
Mamta in marketing, Mark in finance, and Joe in legal,
who are responsible for their department’s resources and
business critical content. Azure AD Entitlement Management
gives me the ability to delegate access governance to
department managers because they’re the ones with knowledge
of who needs access and to which resources. With this, the
right people are managing access for their departments
without IT involvement. With me, I have Mamta Kumar, the
Marketing Manager at Woodgrove Bank. She is the department
head. Let’s do a walkthrough of how an IT admin can delegate
access governance to department managers.
Here, we’re on the identity governance page and we’re
going to navigate to the settings.
We have a new role that is specific to Entitlement
Management that is managed in the Entitlement Management
portal; it’s called the catalog creator role and I can add
specific users or groups to it.
Here, I’m going to go ahead and edit my settings
and add some catalog creators.
I have a group I already created called ELM Catalog
Creators. I want everyone in here to be a catalog creator,
so I’ll go ahead, select the group, and add them.
Mamta Kumar, that Marketing Manager, is already a member
of this group, so she’ll now have the catalog creator role.
Any user I add later to this group will be able to create
catalogs in Entitlement Management, so they can manage
their own resources without IT involvement.
I’m going to send an email to my catalog creators, so they
know what they need to do. Similar to delegating to Mamta,
I can delegate to Mark in finance and to Joe in legal. Mark
and Joe can then create their respective finance and legal
catalogs. Note that Mamta in marketing cannot see Mark’s
catalog in finance or Joe’s catalog in legal. Also, Mark and Joe
cannot see Mamta’s catalog in marketing.
Mamta: Thanks, Hana, for delegating this role of Catalog
Creator to me. I see the email you sent with the instructions
on what I as a catalog creator should do. There are certain
must do tasks for me in this role. However, I can also share
these tasks with other catalog owners.
Let’s take a step by step view. The first step is to create
a catalog. There isn’t already a marketing catalog, so I
need to create one. As the catalog creator, I’m automatically
the owner of this catalog.
Next, some of my colleagues in the marketing department
as original catalog owners. This will help me share the
catalog management tasks with my catalog co-owners.
I’m going to add Bob.
Bob is now a co-owner of this catalog. Bob cannot create
new catalogs, however, he can do all owner tasks within this
catalog.
As the Marketing Manager, I know what resources the
marketing department needs.
I’m also the app owner for the apps that my marketing
department uses, such as Box, Doodle, and Salesforce, so
I’m going to add them.
I’m also the owner of a few marketing sites and site
collections.
I will add a few SPO site collections.
Now, my catalog creation is complete and my catalog is
ready for use.
Hana: Thanks for joining us to learn about delegation in
Azure AD Entitlement Management. In our next video, we
will talk about how the catalog owners can further delegate
to access package managers. To learn more, check out our
other videos.
[MUSIC]