In this video, I'll show you the end to end experience
from creating an access review,
perform one as a group owner and a guest and finally look at the
review results and download the audit logs.
First, we'll start in the Azure portal as an IT admin,
here you can go ahead to the search bar and type an access reviews
go to overview and in the quick tasks you will find
you can do and review on group of members or application access.
Let's go ahead and create a group review
you can type in a name and description of a review and for the start date
the default is to-- today but you can also set it in the future.
We've added an item called frequency here you can
create to be current reviews,
it's set default as one time but you can also set it to
weekly, monthly, quarterly or annually you can set duration for
the review in number of days
and you can also define how it will end.
You can let it to never end, end by a specific date
or end after how many occurrences. In users review
you can review members of a group
or users who have been assigned to an application
in the users scope you can review everybody or it just the guest users.
Let's go ahead and select an office group,
in groups there's something we've heard a lot from organizations
that are rolling out office groups
leveraging the power of self-service enabling anyone in the
organization to create groups and invite guests into groups
it's really convenient that guests are getting
access easily but you also want to make sure
that you have some oversight over all these office groups.
And in Reviewers we added the flexibility for you to choose
who you can assign the reviewers to be
since, we're reviewing a group we can assign the group owners as
a reviewers. You also have the option of selecting individual users from
directory or if you're reviewing guests only
or a large set of users
you can select members making this self review
so that they will review their own access.
This could also be a part of the two-step review where you could ask
guests to review themselves first then assign individual users
such as director of marketing or finance
to do at the second review.
And programs is a notion that we introduced
it can be any governance risk management or compliance activity
that are relevant to your organization
and it's good to have these a separate initiatives for a lifecycle management
such as GDPR and financial and controls, so that
when auditors come they can get straight to what's relevant to them.
In the event settings you can find upon completion
you can enable auto apply of decisions, when this is turn on
the decisions submitted by reviewers will be applied automatically
when the review completes and if there are users who are not reviewed
you can specify what happens to their access,
no change, remove their access approve them
or you can take our system recommendations.
Now you can click start to create that review
now has how you can use access reviews to review an office group that
has customer sensitive information. Here I'm going to switch gears
and show you what does it look like for someone who is invited to do a review.
First of all the reviewers will get an email
you will have who has invited them to do the review
what their group name is and when do they have to complete the review by.
You can customize the description and the title in this email
for the reviewer, after they click on the start review button
they'll be taken to the reviewer experience
which is in the access panel.
This is the review experience
and you can see you have some information about this review
and a list of a user for you to review
important note here is that we're trying to make the experience
fast and easy for the reviewer for presenting with them was just one page
without the complexities of the Azure portal
second you want to show them as much information as possible
to help them make that review.
In this column we have access info which is signed in information
about the user on this particular group or application.
If the users have not been using the resource we will recommend Deny
and if it they did for example
signed in at least once in the last 30 days
then we would recommend Approve their continue access.
As a reviewer of course you can go ahead and change the recommendation
you can also select Don't know,
if you are not sure you're the right reviewer for this user
you can also accept recommendations on this review
if you think the recommended actions look right to you
after I click on accept recommendations
you will see summary of all the users since you review
and the decisions that will be applied to them.
After I click on okay the default recommendations will be accepted
and all these results will be sent back to the IT admin.
So this is experience for the reviewer who's reviewing multiple users
if you're asking a guest to do a self review
I'll show you the experience here.
We've built an even easier UI where they'll have a simple yes or no question
to do you still have access
and as a guest they can even do it on their mobile phones
that was the reviewer experience in the access panel,
to review a list of users as a group owner and also as a guest.
Now I'm going to show you
how you can review the results and download the audit logs as an IT admin?
Going back to the azure portal you see a list of review's running
and had going to each one to track its progress.
In results you can see the list of users been reviewed
and the system recommendations and decisions submitted
by the reviewers along with their business justification.
All these activities are logged
and can download the review and audit logs as spreadsheets.
In audit logs you can see when the review was recreated
and any activity relevant to the decisions
and download this as a spreadsheet to give it to your auditors.
If you had auto apply enabled
these decisions will be executed as a review completes,
you can also stop the review at any point,
apply the results and the denied users will be removed from that resource.
For groups that started on Prem you can still apply the decisions by download
the results of that review and you will get spreadsheets
and get handed of to whoever is responsible for that group
and it's also possible to run a PowerShell script
to move those denied users
if you're looking to something more sophisticated
we're bringing additional APIs and PowerShell so that I can have
the complete examples of these scenarios
that was assembled here in that portal through Power-Shell and graph.
In the next video I'll show you how you can
deploy access reviews in your organization.