[MUSIC]
Hana Kim: Welcome back. In this video, we will talk about
further delegation in Entitlement Management, where
catalog owners can delegate to access package managers.
Mamta Kumar: The catalog is simply a container of
resources. As the catalog creator, my next task is to create
an access package. An access package is a bundle of
resources that a team or project needs and is governed
by policies. This is where I have two choices. I ask myself
whether I have all the information I need to create and
publish an access package. If I’m involved in the day to day
operations of the project, then I know who needs access for
how long and what resources.
In our first marketing project, we are working with a partner
company, Graphic Design Institute. I am involved in the
day to day operations of this project. I know what resources
we will need, who needs access and for how long this project
will last, so I will create an access package for this first
project. In our second marketing project with the design
team and Woodgrove Bank, Jessica is the lead on this project.
She is involved in the day to day operations of this project.
As a catalog owner, I can delegate the creation and management
of access packages within this catalog to access package
manager. I will make Jessica an access package manager
so that she can set up that access package for the second
project.
We have a new role that is specific to Entitlement Management
that is managed in the Entitlement Management portal. It’s
called the Access Package Manager role. I can add specific
users or groups to this role. For the second marketing
project, Jessica is the lead. I am adding Jessica as the
access package manager to this catalog.
I will now inform Jessica that she is an access package
manager for the marketing team. She can now create an
access package for her project.
Hana: As the access package manager, I know which
resources my users need. I am the right person to configure
the policies, as I know who needs access, who needs to
approve, and when the access should expire.
The first step is to create an access package. Then I need to
select from resources already in the catalog and add them
to the access package. Then I need to define the governing
policies for access.
Here, I’m on the Entitlement Management portal. And I see
the marketing department catalog because I have access
package manager permissions for it. I want to create a new
access package.
And I’m going to go ahead and select all the resources
needed for this campaign. Note that I can only add
resources that have already been added to the catalog.
I’m going to need Box and Doodle, as well as the
marketing content SharePoint site.
I’m going to go ahead and click the role that I want my users
to be assigned to these resources as. And next, I’m going to
create the governing policy to tell me who can request
access and how.
So, I already have a group that I want to allow to request
this. All marketing users.
I want to require approval and I want either myself or
Mamta Kumar to make that decision.
And I know that my users should only have access to these
resources for 10 days. So, I’ll have their access expire 10
days after its been granted. Everything looks right to me,
so I’ll enable the policy. Review and create.
I can now share the access package link with my marketing
team for them to request access to the access package.
As the access package manager, I can see and manage other
packages in the marketing catalog but not in any other
catalog. Also, other access package managers in this catalog
will be able to manage the package I just created.
Mamta: Thanks for joining us to learn about further delegation
in Azure AD Entitlement Management. To learn more, please
watch our other videos.
[MUSIC]