You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: articles/active-directory/governance/access-reviews-overview.md
+22-15Lines changed: 22 additions & 15 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -12,7 +12,7 @@ ms.tgt_pltfrm: na
12
12
ms.devlang: na
13
13
ms.topic: conceptual
14
14
ms.subservice: compliance
15
-
ms.date: 08/05/2019
15
+
ms.date: 01/10/2020
16
16
ms.author: ajburnle
17
17
ms.reviewer: mwahl
18
18
ms.collection: M365-identity-device-management
@@ -92,27 +92,34 @@ If you are ready to deploy access reviews in your organization, follow these ste
92
92
93
93
[!INCLUDE [Azure AD Premium P2 license](../../../includes/active-directory-p2-license.md)]
94
94
95
-
### Which users must have licenses?
95
+
### How many licenses must you have?
96
96
97
-
Each user who interacts with access reviews must have a paid Azure AD Premium P2 license. Examples include:
97
+
Ensure that your directory has at least as many Azure AD Premium P2 licenses as you have employees that will be performing the following tasks:
98
98
99
-
- Administrators who create an access review
99
+
- Member and guest users who are assigned as reviewers
100
+
- Member and guest users who perform a self-review
100
101
- Group owners who perform an access review
101
-
- Users assigned as reviewers
102
-
- Users who perform a self-review
102
+
- Application owners who perform an access review
103
103
104
-
You can also ask guest users to review their own access. For each paid Azure AD Premium P2 license that you assign to one of your own organization's users, you can use Azure AD business-to-business (B2B) to invite up to five guest users under the External User Allowance. These guest users can also use Azure AD Premium P2 features. For more information, see [Azure AD B2B collaboration licensing guidance](../b2b/licensing-guidance.md).
104
+
Azure AD Premium P2 licenses are **not** required for the following tasks:
105
105
106
-
Here are some example scenarios to help you determine the number of licenses you must have.
106
+
- No licenses are required for the users with the Global Administrator or User Administrator roles that set up access reviews, configure settings, or apply the decisions from the reviews.
107
107
108
-
| Scenario | Calculation | Required number of licenses |
109
-
| --- | --- | --- |
110
-
| An administrator creates an access review of Group A with 500 users. Assigns 3 group owners as reviewers. | 1 license for the administrator + 3 licenses for each group owner as reviewers. | 4 |
111
-
| An administrator creates an access review of Group A with 500 users. Makes it a self-review. | 1 license for the administrator + 500 licenses for each user as self-reviewers. | 501 |
112
-
| An administrator creates an access review of Group B with 5 users and 25 guest users. Makes it a self-review. | 1 license for the administrator + 5 licenses for each user as self-reviewers.<br/>(guest users are covered in the required 1:5 ratio) | 6 |
113
-
| An administrator creates an access review of Group C with 5 users and 108 guest users. Makes it a self-review. | 1 license for the administrator + 5 licenses for each user as self-reviewers + 16 additional licenses to cover all 108 guest users in the required 1:5 ratio.<br/>1+5=6 licenses, which cover 5\*6=30 guest users. For the remaining (108-5\*6)=78 guest users, 78/5=16 additional licenses are required. Thus in total, 6+16=22 licenses are required. | 22 |
108
+
For each paid Azure AD Premium P2 license that you assign to one of your own organization's users, you can use Azure AD business-to-business (B2B) to invite up to five guest users under the External User Allowance. These guest users can also use Azure AD Premium P2 features. For more information, see [Azure AD B2B collaboration licensing guidance](../b2b/licensing-guidance.md).
109
+
110
+
For more information about licenses, see [Assign or remove licenses using the Azure Active Directory portal](../fundamentals/license-users-groups.md).
111
+
112
+
### Example license scenarios
114
113
115
-
For information about how to assign licenses to your uses, see [Assign or remove licenses using the Azure Active Directory portal](../fundamentals/license-users-groups.md).
114
+
Here are some example license scenarios to help you determine the number of licenses you must have.
115
+
116
+
| Scenario | Calculation | Number of licenses |
117
+
| --- | --- | --- |
118
+
| An administrator creates an access review of Group A with 75 users and 1 group owner, and assigns the group owner as the reviewer. | 1 license for the group owner as reviewer | 1 |
119
+
| An administrator creates an access review of Group B with 500 users and 3 group owners, and assigns the 3 group owners as reviewers. | 3 licenses for each group owner as reviewers | 3 |
120
+
| An administrator creates an access review of Group B with 500 users. Makes it a self-review. | 500 licenses for each user as self-reviewers | 500 |
121
+
| An administrator creates an access review of Group C with 50 member users and 25 guest users. Makes it a self-review. | 50 licenses for each user as self-reviewers.<br/>(guest users are covered in the required 1:5 ratio) | 50 |
122
+
| An administrator creates an access review of Group D with 6 member users and 108 guest users. Makes it a self-review. | 6 licenses for each user as self-reviewers + 16 additional licenses to cover all 108 guest users in the required 1:5 ratio. 6 licenses, which cover 6\*5=30 guest users. For the remaining (108-6\*5)=78 guest users, 78/5=16 additional licenses are required. Thus in total, 6+16=22 licenses are required. | 22 |
Copy file name to clipboardExpand all lines: articles/active-directory/governance/entitlement-management-overview.md
+23-8Lines changed: 23 additions & 8 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -12,7 +12,7 @@ ms.tgt_pltfrm: na
12
12
ms.devlang: na
13
13
ms.topic: conceptual
14
14
ms.subservice: compliance
15
-
ms.date: 10/24/2019
15
+
ms.date: 01/10/2020
16
16
ms.author: ajburnle
17
17
ms.reviewer: markwahl-msft
18
18
ms.collection: M365-identity-device-management
@@ -132,17 +132,32 @@ To better understand entitlement management and its documentation, you can refer
132
132
133
133
Specialized clouds, such as Azure Government, Azure Germany, and Azure China 21Vianet, are not currently available for use.
134
134
135
-
### Which users must have licenses?
135
+
### How many licenses must you have?
136
136
137
-
Your tenant must have at least as many Azure AD Premium P2 licenses as you have member users active in entitlement management. Active member users in entitlement management include:
137
+
Ensure that your directory has at least as many Azure AD Premium P2 licenses as you have employees that will be performing the following tasks:
138
138
139
-
-A user that initiates or approves a request for an access package.
140
-
-A user that has been assigned an access package.
141
-
-A user that manages access packages.
139
+
-Member users who **can**request an access package.
140
+
-Member and guest users who request an access package.
141
+
-Member and guest users who approve requests for an access package.
142
142
143
-
As part of the licenses for member users, you can also allow a number of guest users to interact with entitlement management. For information about how to calculate the number of guest users you can include, see [Azure Active Directory B2B collaboration licensing guidance](../b2b/licensing-guidance.md).
143
+
Azure AD Premium P2 licenses are **not** required for the following tasks:
144
144
145
-
For information about how to assign licenses to your users, see [Assign or remove licenses using the Azure Active Directory portal](../fundamentals/license-users-groups.md). Note that entitlement management currently does not enforce license assignment for users.
145
+
- No licenses are required for users with the Global Administrator role who set up the initial catalogs, access packages, and policies, and delegate administrative tasks to other users.
146
+
- No licenses are required for users who have been delegated administrative tasks, such as catalog creator, catalog owner, and access package manager.
147
+
- No licenses are required for guests who **can** request access packages, but do **not** request an access package.
148
+
149
+
For each paid Azure AD Premium P2 license that you purchase for your member users (employees), you can use Azure AD B2B to invite up to 5 guest users. These guest users can also use Azure AD Premium P2 features. For more information, see [Azure AD B2B collaboration licensing guidance](../b2b/licensing-guidance.md).
150
+
151
+
For more information about licenses, see [Assign or remove licenses using the Azure Active Directory portal](../fundamentals/license-users-groups.md).
152
+
153
+
### Example license scenarios
154
+
155
+
Here are some example license scenarios to help you determine the number of licenses you must have.
156
+
157
+
| Scenario | Calculation | Number of licenses |
158
+
| --- | --- | --- |
159
+
| A Global Administrator at Woodgrove Bank creates initial catalogs and delegates administrative tasks to 6 other users. One of the policies specifies that **All employees** (2,000 employees) can request a specific set of access packages. 150 employees request the access packages. | 2,000 employees who **can** request the access packages | 2,000 |
160
+
| A Global Administrator at Woodgrove Bank creates initial catalogs and delegates administrative tasks to 6 other users. One of the policies specifies that **All employees** (2,000 employees) can request a specific set of access packages. Another policy specifies that some users from **Users from partner Contoso** (guests) can request the same access packages subject to approval. Contoso has 30,000 users. 150 employees request the access packages and 10,500 users from Contoso request access. | 2,000 employees + 500 guest users from Contoso that exceed the 1:5 ratio (10,500 - (2,000 * 5)) | 2,500 |
To use Azure Active Directory (Azure AD) Privileged Identity Management (PIM), a directory must have a valid license. Furthermore, licenses must be assigned to the administrators and relevant users. This article describes the license requirements to use Privileged Identity Management.
26
26
27
-
## Prerequisites
27
+
## Valid licenses
28
28
29
-
To use Privileged Identity Management, your directory must have one of the following paid or trial licenses:
29
+
[!INCLUDE [Azure AD Premium P2 license](../../../includes/active-directory-p2-license.md)]
30
30
31
-
- Azure AD Premium P2
32
-
- Enterprise Mobility + Security (EMS) E5
33
-
- Microsoft 365 M5
31
+
## How many licenses must you have?
34
32
35
-
For more information, see [What is Azure Active Directory?](../fundamentals/active-directory-whatis.md).
33
+
Ensure that your directory has at least as many Azure AD Premium P2 licenses as you have employees that will be performing the following tasks:
36
34
37
-
## Which users must have licenses?
38
-
39
-
Each administrator or user who interacts with or receives a benefit from Privileged Identity Management must have a license. Examples include:
40
-
41
-
- Administrators with Azure AD roles managed using PIM
42
-
- Administrators with Azure resource roles managed using PIM
43
-
- Administrators assigned to the Privileged Role Administrator role
44
35
- Users assigned as eligible to Azure AD roles managed using PIM
45
-
- Users able to approve/reject requests in PIM
36
+
- Users able to approve or reject activation requests in PIM
46
37
- Users assigned to an Azure resource role with just-in-time or direct (time-based) assignments
47
38
- Users assigned to an access review
48
39
- Users who perform access reviews
49
40
50
-
For information about how to assign licenses to your uses, see [Assign or remove licenses using the Azure Active Directory portal](../fundamentals/license-users-groups.md).
41
+
Azure AD Premium P2 licenses are **not** required for the following tasks:
42
+
43
+
- No licenses are required for users with the Global Administrator or Privileged Role Administrator roles that set up PIM, configure policies, receive alerts, and set up access reviews.
44
+
45
+
For more information about licenses, see [Assign or remove licenses using the Azure Active Directory portal](../fundamentals/license-users-groups.md).
46
+
47
+
## Example license scenarios
48
+
49
+
Here are some example license scenarios to help you determine the number of licenses you must have.
50
+
51
+
| Scenario | Calculation | Number of licenses |
52
+
| --- | --- | --- |
53
+
| Woodgrove Bank has 10 administrators for different departments and 2 Global Administrators that configure and manage PIM. They make five administrators eligible. | Five licenses for the administrators who are eligible | 5 |
54
+
| Graphic Design Institute has 25 administrators of which 14 are managed through PIM. Role activation requires approval and there are three different users in the organization who can approve activations. | 14 licenses for the eligible roles + three approvers | 17 |
55
+
| Contoso has 50 administrators of which 42 are managed through PIM. Role activation requires approval and there are five different users in the organization who can approve activations. Contoso also does monthly reviews of users assigned to administrator roles and reviewers are the users’ managers of which six are not in administrator roles managed by PIM. | 42 licenses for the eligible roles + five approvers + six reviewers | 53 |
0 commit comments