[Beeping]
Why don't we take a second and actually show what
Access Rights Manager looks like
in terms of managing a hybrid,
both on-prem and out to Azure,
and more from the user perspective.
OK, in case you haven't seen this before,
this is Access Rights Manager, and again,
it's designed to make it easy to figure out
what users have access to what, whether they're on-prem
or they're using cloud resources, right?
So, there's a lot of reports that people tend to use
right off the bat, like who has access to what?
And we'll pick on marketing, of course, because we like to.
And we'll take a look at the resources
that they are using, and specifically, I want to know
what are they doing in the marketing share
on this server.
So, I'm going to double-click this,
it's going to select my role, and then I can do things like
also, maybe I want to look at group structure,
or I want to actually look at the ACLs
that are applied for that.
And then I'm going to click start,
and it's going to run that report for me.
So there's a ton of just base reports
of who has access where,
but that's not what most people are actually using this for.
What most people are doing are thinking about it more
from the resource role, especially when, to your point,
of trying to get parity between what we were doing on-prem,
and with what we are now doing in the cloud.
Or someone says, "I had that before we went to O365,
but now I don't."
OK, well, in this case here,
I've got Active Directory up here at the top.
So, this one happens to be a local instance,
but if I was connected to Azure AD,
it would look exactly the same.
I get my roles and groups, I get things like
everything from built-in roles,
including their access rights, the users underneath.
But when Tom and I were talking about this yesterday,
so often it ends up being an individual user, right?
And we were talking about it before,
if a help desk request ends up being access permissions,
it always ends up getting escalated to layer two or three,
because they're asking for an exception.
But in this case, let's pick on Anton, let's find him.
>>Anton Admin.
>>Anton Admin, yeah.
Well, look, there he is, he's a user.
Here we can see Anton's access and the account permissions
for this archive share, right?
Well, one of the things I do care about,
is I care about things like inheritance,
like where did these permissions actually come from?
And if I want to make changes, I can right-click
and then say, "Oh, let's change
the inheritance rules for that."
>>Oh, look at that.
>>Right? Now technically, that's an exception,
because that is for this user on that file share,
but where it gets a little bit more interesting,
is if you want to take a look at a user
where they are compared to everyone else.
And for that, we're going to use the show accounts view.
Now, for those of you who've used NetPath,
or the new mapping, this will look pretty friendly.
And of course, you get-
>>Oh there's a photo of him,
so now I can go around the office looking for him.
>>Right? But again, we're focused on that user,
so this is everything that we know about him,
last log on, the organization in the tree.
But here I can see all of the parents
that are a part of this view, and then also,
the resources that he has access to.
And if I want to, I can go ahead and walk through these,
so I can figure out-
>>Oh, so you can see the group nesting.
>>Visualization of it, yeah.
>>And then I can also do things like
look at exceptions, I can do reports and identifications
of exceptions that way as well.
>>You know where I can see this as being very useful?
>>In Azure?
>>Of course, but when an individual transitions roles,
when they leave a department.
How often does permissions get left behind?
The intention is there,
you want to remove the old permissions and get the new ones,
but sometimes you end up with both, your new and your old,
and you still have it
because there's that transition period
that sometimes- >>Sometimes, all the time.
>>That doesn't always get cleaned up,
so this is a great visualization of,
"Wow, Anton, does he really need access to all that?"
and "I thought he's not in marketing anymore."
>>No, of course he does, it says "Admin" in his name,
of course he needs access to all those things.
[radio tuning]
>>OK, so we looked at a couple different paths, right?
So, the first one was resources
drilled down to groups and users,
so figure out who has access to what
from the resource perspective.
The other one was from the user perspective,
what resources are available and how are they different
and when were things applied?
But when you really start to look at this in aggregate,
if you're the administrator,
or if you're the person in charge of governance,
and you need to really have that top-level view
of who's doing what, especially across multiple environments
the log book view is what most people tend to use.
So, there's a couple of things here.
>>The when?
>>The when, and then the volume, right?
So, I can look to say AD accounts created,
there were two of them on this day, and if I drill in.
>>Ah, new hire.
>>I'm going to see who and why,
and then all the changes that were part of that provision.
>>Ooh, use this as a template.
>>Templates are handy, and if you want to see
all the details of how this works in a future episode,
let us know in the chat or on the home page,
and then we'll come back and walk you through
how to actually set this up
and how to use things like templates.
But the other thing too here is
this is sort of looking at that high-level log,
this is how many actions were taken all at once.
But if I want to really look at a specific log,
I'm more likely going to actually be looking at something else.
Like I'm going to be looking at a role or a user.
So in this case, I'm looking, again,
at the graph view for this user for their permissions.
And right here I get the log for that user in that context.
I get a log book right there, but the view is narrowed down
specifically for this user for the roles,
and who's making the changes,
so that I can see all of those right there as well.
>>Oh, there's even details
of a ticket number too, very useful.
>>I know that's a lot, but the point here
is that don't let security and fear of being able
to manage your cloud resources prevent you
from taking advantage.
There are tools available to make that relatively easy.
[Upbeat music]