[MUSIC]
Hana Kim: Welcome back, everyone. We hope you’ve had
a chance to watch the product overview video of
entitlement management.
In this video, we’ll be explaining how to successfully create
and request your first access package.
So, say we’re Woodgrove Bank and we’re kicking off a
marketing campaign. We want to give access to all the
resources needed for the project to the marketing team, so
we’re going to go ahead and show you how to do that.
So first, you want to start off in the Azure Active Directory
portal and find the identity governance tab.
Here, you want to navigate to the access packages,
click on new access package,
here, we can name the access package.
And go ahead and select all the resources needed for this
project. As you can see, we can add groups, applications,
or SharePoint sites. Let’s go ahead and add our first group.
Since the marketing team is going to need access to the
marketing resources, we can go ahead and add that group.
Say the team also needs Salesforce app.
We can add that and any SharePoint sites that the team
might need as well.
After you’ve selected your resources needed for the project,
you can go in and select the actual role that the users are
going to get assigned to that resource as. So for this group,
we want to select member, chatter for user for Salesforce,
and Teams site member for the SharePoint site.
The next step is creating your first policy. A policy is a way
to specify who can request an access package and who has
to approve it or whether it expires or not. So, for this first
policy, I’m going to make it for my employees, so users in
my directory. And I know that I’m going to want the marketing
team to have access to it.
Since this is an internal group of users, I’m not going to
require approval. And I’m also going to let it not expire.
I’ll go ahead and enable that policy, review my settings,
and create the access package.
Here, we’re in the actual access package and you can see a
shareable link that you can provide to any of your employees
where they can directly access and request the access package.
Joe Castellanos: So now, I’m going to show what it looks like from
the end user who just joined the marketing team at Woodgrove
Bank. And I just joined and was told from my manager I need
to get access.
So, I am going to enter the myaccess URL, which will ask
me to sign in.
Once I’m signed in, I will see a list of access packages that
are available to me. So, I can see here I am in scope of
the marketing campaign package that Hana just created.
I can expand here and see the details and the contents of
that package. I can see the groups, the SharePoint sites,
and the applications.
Since I need this, I’m going to go ahead and request it.
I will need to provide a business justification.
I am working on the new marketing campaign, so let’s go
ahead and submit.
So, once I submit, I can actually check out a history of my
requests. So, I can look here and see I just requested this.
It’s submitted. Here’s the date requested. If I select view,
it’ll also show me more details. So, we can actually see
that it was submitted by Phil Taylor. It was auto approved
and now, the system is delivering the access. So, once it’s
approved, the system will start to deliver the package and
all the necessary contents of that package.
If we refresh this again, the package is now delivered. So if
I go into the view, I can see that it was delivering; it’s now
delivered, and I actually got the notification referencing that
it was delivered.
If I navigate to access packages on the left nav, before I can
see the packages I am able to request. If I navigate to active,
I can see the packages that I currently have. I can expand
and see the contents again. I can actually open and launch
the resource from here as well.
Great. Now, I have access to the SharePoint site for the
marketing campaign.
So, Hana, now that I have access, say we just hired
Graphic Design Institute to help out on the project. How do
we get their users access to the package as well?
Hana: So, luckily, we can go ahead back to the same package
and create an additional policy that lets graphic design
institute employees request and access the package. So,
I’m going back into the marketing campaign page. Here, we
see the policies tab. So, we can click through and simply
add a new policy.
So, I know I want to let in the graphic institute designers.
And I’m going to go ahead and select for users not in my
directory, since I know that they’re outside. We can then go
ahead and find the Graphic Design Institute directory
and add it to our policy. Now, since these are guest users,
I’m going to want to add a bunch of security precautions.
I’m going to require approval
and select an admin. I also know that the project with graphic
design institute is going to end at the end of the year.
So, I’m going to go ahead and make sure that it expires
on that date. Now that everything’s ready, I’m going to go
ahead and enable the policy and create it.
Joe: Awesome. Now that this package has been created,
I’m going to show you what a user from Graphic Design
Institute will look like when they need to get access.
In this example, I’m going to play Skye Hunt, and I am
going to need to get access and get signed up for the
marketing campaign. I just joined Graphic Design Institute,
so I have my account in that organization, but I’m looking
to get signed up and get all the access I need within
Woodgrove Bank. So, my manager shared a link with me,
which was myaccess.microsoft.com/woodgrovebank.
I am not a user yet in Woodgrove Bank, but I’m still going to
sign in with my Graphic Design Institute account.
Similar to before with the employee flow, as a guest user,
Skye can still go to myaccess but a tenanted endpoint of
myaccess specific to Woodgrove Bank. They can view the
packages that they’re in scope of, the marketing campaign.
They can look at the description and more details of that
package. And they can request it.
So, they’ll have to provide a business justification, so we
can track why they need access.
Working on this project. And I can acknowledge that my
information provided here may go to an approver from
Woodgrove Bank. I will go ahead and submit. And similar
to before, I get a nice request history page, where I can
track the progress of my request. I can see the details
that I just submitted this. If I click in on view again, I can
see a great history. But now, I can see that it’s pending
approval. So, in this case, a notification when out to someone
inside of Woodgrove Bank notifying them that my request was
made, and they need to go take an action.
Hana: Great. So, I’m going to show you the approver
experience. So fortunately, it’s all one portal, so I’m also going
to log into the Woodgrove Bank myaccess portal.
I’m going to go ahead and log in as the admin, Viktor Ness.
And once I’m in the portal, I can see my own access packages
but also just go straight to this approvals tab to see any
pending approvals I have. Here, I can see that Skye has
requested the marketing campaign access package. I can go
ahead and view some details. I can see our business
justification. And then I can decide whether to approve or
deny.
Once I’ve approved, Skye should have access to the access
package.
Joe: Great. So now as Skye, I’m going to come back to
my request history and check those details again and see if
they’ve been updated. So now, I can see that the details
have been approved. I can check out the reason why it was
approved. And I can see that the contents of the package
are starting to get delivered.
If I navigate to packages now, I should be able to see the
same package under active. I can expand and see the details
of the package. And I can even launch it again as the guest
user.
Now when I try to navigate to the SharePoint site, I must
accept invitation from the other organization.
Now, you will have access to the SharePoint site.
This is how you can enable self-service requests for access
packages. Join us for our next video, where we will explain
how to successfully monitor and scale entitlement management.
[MUSIC]