[MUSIC]
Adwoa Boateng-Kwakye: Hello. My name is Adwoa Boateng-Kwakye
and I’m a Program Manager in the Azure AD Engineering
Group, and I have the pleasure of speaking with Joe today.
Joe, can you tell us about yourself?
Joseph Dadzie: Thanks, Adwoa. I’m Joseph or you can call
me Joe Dadzie, the Group Program Manager in the Azure
AD Engineering team responsible for identity governance
strategy, product features, and roadmap. Happy to be here.
Adwoa: Welcome, Joe.
In this video, we will discuss what identity governance is.
why it’s important for organizations and how Microsoft can
help organizations with the identity governance needs
through the capabilities available in Azure AD.
I hear people use the term identity governance all the time.
What does it mean and how should organizations think
about using it in their businesses?
Joe: If you think about the current digital business landscape,
it is a hyperconnected world with employees working and
collaborating with business partners everywhere, in
the office, coffee shops, home or partner offices to drive
business value. The only way to know who is accessing a
company’s resources is by verifying the user’s identity
and whether they are authorized to access the SharePoint
sites, Teams groups or application they are seeking to
reach. This is critical for securing organizations against
new threats like phishing attacks and privacy breaches.
Identity governance is how an organization can appropriately
balance the needs for security and employee productivity,
who has or should have access to resources, delegation of
responsibility to business units, while IT maintains visibility
into access patterns and repeatable processes that
organizations can rely on and prove to auditors that they
have the appropriate controls for compliance.
Adwoa: You mentioned security and we know security is
top of mind for our customers. Is governance just more
security that will slow me down to do my work?
Joe: Not really, but they are related. Governance is a mix
of repeatable processes and tools to ensure that the right
users have appropriate access to do their work and no more.
When done right with self-service capabilities, it actually
accelerates business productivity and enhances security
because users now have predictable ways to get access
to and share resources that are compliant with company
policies. IT employee resources can now be freed up for
other strategic initiatives.
Adwoa: Okay. Good to know that organizations can be
secure without reducing their productivity.
So, there are several features that come with Azure AD.
Can you explain how Azure AD addresses governance
challenges for an organization?
Joe: Yes. Azure AD’s identity governance features can be
broadly put into three categories. One, the identity lifecycle,
how user identities, either employees or business guests
get into the organization either from HR systems or self-
service tools that organizations may have built and how
they eventually leave the organization.
Azure AD provides features to support identity provisioning
from HR systems, on-premises, and cloud ones like
Workday and self-service scenarios for business guests.
It also provides features to clean up unused guest accounts
an often forgotten part of their lifecycle.
Secondly, the access lifecycle, how access to resources are
managed, when is accessed provisioned, deprovisioned,
and from where, and the necessary approval processes for
critical resources like customer data or financial information.
Some of the Azure AD features include automatic pre-
integrated provisioning and deprovisioning of user access
into SaaS applications or an organization’s own line of
business ones. Additionally, the access reviews features
automate the process of reviewing guest access across
the organization to mitigate the risk of inappropriate
access.
Third, the privilege access management, these are the
additional controls required to ensure that users with
admin credentials and privileges are working in a least
privilege mode to reduce access and security risks. The
privilege identity management feature, PIM, provides
privileged role monitoring, revalidating
admin user identities when they get those admin privileges,
and time limited just in time privileged access.
Additionally, approval workflows ensure there’s appropriate
oversight and PIM works across Azure AD connected
services like Microsoft 365 administrator roles as well as
Azure resource rules.
Adwoa: Thanks for describing Azure AD’s governance
capabilities. I know there are other governance products
available in the market, so what makes Microsoft’s solution
unique?
Joe: Great question. As organizations implement their digital
transformation strategies, some of the key challenges are
how to reduce their risk in adoption of cloud or SaaS
applications and how to make sure that as employees
collaborate with more and more users outside organization
access risk is not increased. Microsoft’s identity governance
solution is, therefore, designed as a cloud based solution
that is policy and configuration based and is quick to deploy
to address these new risks related to digital transformation.
For example, it is designed to be quick to get value from and
easily configurable as organizations already have Azure AD
through their Office 365 subscription. It builds on the Azure
AD investment an organization has, single sign-on and
provisioning integration with non-Microsoft SaaS applications
like Service Now. And there’s no require process re-engineering
to get value.
As I mentioned earlier, it addresses the new emerging
collaboration risk that comes with cloud adoption. Example,
guest access management, which wasn’t a problem organizations
had to worry about in traditional identity governance
approaches. It’s also designed to easily fit in with other
processes and tools an organization may already have
through standards like SCIM and graph APIs. There’s no
need to replace working existing tools.
And lastly, it will evolve over time to include capabilities to
support governance of access to on-premises resources
for customers in a hybrid environment.
Adwoa: Thank you, Joe, for explaining why identity
governance is, why organizations need it, and how
Microsoft addresses those needs.
Thanks for joining us. Be sure to watch the next video
where we go through two case studies and describe how
customers use Azure AD features to solve their business
challenges.
[MUSIC]