Last Updated on March 18, 2019 by Dishan M. Francis
Corporate applications may also hold critical operation data related to the company. By doing regular reviews, we can make sure only the relevant people have access to corporate applications. However, if we just use the native method, it will be mainly based on Enterprise app Sign-ins and audit log data. the only problem with this method is, it is so time-consuming. As it is all manual process, the result may not be that accurate either. But now with Azure AD Access reviews, we can do this by setting up a simple access review job. Here is why it is good rather than a typical audit.
Automated – It is all automated. You do not need to go through logs and do anything manually.
Actions – we can also attach predefined action to execute at the end of a successful access review job. If required, we also can manually decide what to do with the findings (approve or deny access)
Schedule – Access reviews jobs can be scheduled to run periodically. It helps to do it more frequently than the manual method.
Recommendation – Access review job itself provides recommendations based on findings. It helps reviewers to decide.
Delegations – Access reviews job allows delegation. We can assign someone else in the team to decide what to do with the findings. It helps to get more accurate results.
So, let's go ahead and see how it works. In my demo environment, I have linkedin application assigned to different groups and users. I like to know who has access to it and do permission changes if required.
1. To start, log in to Azure portal as Global Administrator
2. Then make sure Access reviews onboarding process is completed. More info about this can be found in one of my previous blog posts https://www.rebeladmin.com/2019/02/step-step-guide-review-privileged-accounts-using-azure-pim/
3. To create a new access review job, go to Access Reviews | Controls
4. Then click on + New Access Review
[Read more…] about Step-by-Step Guide: Azure AD Access Reviews for Applications
