You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: articles/active-directory/privileged-identity-management/azure-ad-pim-approval-workflow.md
+44-44Lines changed: 44 additions & 44 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -35,103 +35,103 @@ Beginning in November 2019, the Azure AD roles portion of Privileged Identity Ma
35
35
36
36
Follow the steps in this article to approve or deny requests for Azure AD roles.
37
37
38
-
# [Previous version](#tab/previous)
38
+
# [New version](#tab/new)
39
39
40
40
## View pending requests
41
41
42
-
As a delegated approver, you'll receive an email notification when an Azure AD role request is pending your approval. You can view these pending requests in Privileged Identity Management.
42
+
As a delegated approver, you'll receive an email notification when an Azure resource role request is pending your approval. You can view these pending requests in Privileged Identity Management.
43
43
44
44
1. Sign in to the [Azure portal](https://portal.azure.com/).
45
45
46
46
1. Open **Azure AD Privileged Identity Management**.
47
47
48
-
1. Click **Azure AD roles**.
49
-
50
-
1. Click **Approve requests**.
48
+
1. Select **Approve requests**.
51
49
52
-
50
+
53
51
54
-
You'll see a list of requests pending your approval.
52
+
In the **Requests for role activations** section, you'll see a list of requests pending your approval.
55
53
56
54
## Approve requests
57
55
58
-
1.Select the requests you want to approve and then click **Approve** to open the Approve selected requests pane.
56
+
1.Find and select the request that you want to approve. An approve or deny page appears.
59
57
60
-
58
+
61
59
62
-
1. In the **Approve reason** box, type a reason.
60
+
1. In the **Justification** box, enter the business justification.
63
61
64
-
62
+
1. Select **Approve**. You will receive an Azure notification of your approval.
65
63
66
-
1. Click **Approve**.
64
+
67
65
68
-
The Status symbol will be updated with your approval.
66
+
## Deny requests
69
67
70
-
68
+
1. Find and select the request that you want to deny. An approve or deny page appears.
71
69
72
-
## Deny requests
70
+
73
71
74
-
1.Select the requests you want to deny and then click **Deny**to open the Deny selected requests pane.
72
+
1.In the **Justification**box, enter the business justification.
75
73
76
-
74
+
1. Select **Deny**. A notification appears with your denial.
77
75
78
-
1. In the **Deny reason** box, type a reason.
76
+
## Workflow notifications
79
77
80
-
78
+
Here's some information about workflow notifications:
81
79
82
-
1. Click **Deny**.
80
+
- Approvers are notified by email when a request for a role is pending their review. Email notifications include a direct link to the request, where the approver can approve or deny.
81
+
- Requests are resolved by the first approver who approves or denies.
82
+
- When an approver responds to the request, all approvers are notified of the action.
83
+
- Resource administrators are notified when an approved user becomes active in their role.
83
84
84
-
The Status symbol will be updated with your denial.
85
+
>[!NOTE]
86
+
>A resource administrator who believes that an approved user should not be active can remove the active role assignment in Privileged Identity Management. Although resource administrators are not notified of pending requests unless they are an approver, they can view and cancel pending requests for all users by viewing pending requests in Privileged Identity Management.
85
87
86
-
# [New version](#tab/new)
88
+
# [Previous version](#tab/previous)
87
89
88
90
## View pending requests
89
91
90
-
As a delegated approver, you'll receive an email notification when an Azure resource role request is pending your approval. You can view these pending requests in Privileged Identity Management.
92
+
As a delegated approver, you'll receive an email notification when an Azure AD role request is pending your approval. You can view these pending requests in Privileged Identity Management.
91
93
92
94
1. Sign in to the [Azure portal](https://portal.azure.com/).
93
95
94
96
1. Open **Azure AD Privileged Identity Management**.
95
97
96
-
1.Select**Approve requests**.
98
+
1.Click**Azure AD roles**.
97
99
98
-
100
+
1. Click **Approve requests**.
99
101
100
-
In the **Requests for role activations** section, you'll see a list of requests pending your approval.
102
+
103
+
104
+
You'll see a list of requests pending your approval.
101
105
102
106
## Approve requests
103
107
104
-
1.Find and select the request that you want to approve. An approve or deny page appears.
108
+
1.Select the requests you want to approve and then click **Approve** to open the Approve selected requests pane.
105
109
106
-
110
+
107
111
108
-
1. In the **Justification** box, enter the business justification.
112
+
1. In the **Approve reason** box, type a reason.
109
113
110
-
1. Select **Approve**. You will receive an Azure notification of your approval.
114
+
111
115
112
-
116
+
1. Click **Approve**.
113
117
114
-
## Deny requests
118
+
The Status symbol will be updated with your approval.
115
119
116
-
1. Find and select the request that you want to deny. An approve or deny page appears.
120
+
117
121
118
-
122
+
## Deny requests
119
123
120
-
1.In the **Justification**box, enter the business justification.
124
+
1.Select the requests you want to deny and then click **Deny**to open the Deny selected requests pane.
121
125
122
-
1. Select **Deny**. A notification appears with your denial.
126
+
123
127
124
-
## Workflow notifications
128
+
1. In the **Deny reason** box, type a reason.
125
129
126
-
Here's some information about workflow notifications:
130
+
127
131
128
-
- Approvers are notified by email when a request for a role is pending their review. Email notifications include a direct link to the request, where the approver can approve or deny.
129
-
- Requests are resolved by the first approver who approves or denies.
130
-
- When an approver responds to the request, all approvers are notified of the action.
131
-
- Resource administrators are notified when an approved user becomes active in their role.
132
+
1. Click **Deny**.
132
133
133
-
>[!NOTE]
134
-
>A resource administrator who believes that an approved user should not be active can remove the active role assignment in Privileged Identity Management. Although resource administrators are not notified of pending requests unless they are an approver, they can view and cancel pending requests for all users by viewing pending requests in Privileged Identity Management.
134
+
The Status symbol will be updated with your denial.
Copy file name to clipboardExpand all lines: articles/active-directory/privileged-identity-management/pim-deployment-plan.md
+3-3Lines changed: 3 additions & 3 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -10,7 +10,7 @@ ms.service: active-directory
10
10
ms.topic: conceptual
11
11
ms.workload: identity
12
12
ms.subservice: pim
13
-
ms.date: 11/08/2019
13
+
ms.date: 02/04/2020
14
14
ms.author: curtand
15
15
ms.custom:
16
16
ms.collection: M365-identity-device-management
@@ -115,7 +115,7 @@ The following section helps you identify all the stakeholders that are involved
115
115
116
116
As part of the planning process, you must first consent to and enable Privileged Identity Management by following our [start using Privileged Identity Management](pim-getting-started.md) article. Enabling Privileged Identity Management gives you access to some features that are specifically designed to help with your deployment.
117
117
118
-
If your objective is to deploy Privileged Identity Management for Azure resources, you should follow our [discover Azure resources to manage in Privileged Identity Management](pim-resource-roles-discover-resources.md) article. Only owners of each resource, resource group, and subscription will be able to discover them inside Privileged Identity Management. If you are a Global Administrator trying to deploy Privileged Identity Management for your Azure resources, you can [elevate access to manage all Azure subscriptions](../../role-based-access-control/elevate-access-global-admin.md?toc=%2fazure%2factive-directory%2fprivileged-identity-management%2ftoc.json) to give yourself access to all Azure resources in the directory for discovery. However, we advise that you get approval from each of your subscription owners before managing their resources with Privileged Identity Management.
118
+
If your objective is to deploy Privileged Identity Management for Azure resources, you should follow our [discover Azure resources to manage in Privileged Identity Management](pim-resource-roles-discover-resources.md) article. Only owners of subscriptions and management groups can discover and onboard these resources onto Privileged Identity Management. After it is onboarded, the PIM functionality is available for owners at all levels including management group, subscription, resource group, and resource. If you are a Global Administrator trying to deploy Privileged Identity Management for your Azure resources, you can [elevate access to manage all Azure subscriptions](../../role-based-access-control/elevate-access-global-admin.md?toc=%2fazure%2factive-directory%2fprivileged-identity-management%2ftoc.json) to give yourself access to all Azure resources in the directory for discovery. However, we advise that you get approval from each of your subscription owners before managing their resources with Privileged Identity Management.
119
119
120
120
### Enforce principle of least privilege
121
121
@@ -193,7 +193,7 @@ If there are any roles with guest users assigned, they are particularly vulnerab
193
193
> [!TIP]
194
194
> :heavy_check_mark:**Microsoft recommends** you manage all roles with guest users using Privileged Identity Management to reduce risk associated with compromised guest user accounts.
195
195
196
-
Reader roles like the Directory Reader, Message Center Reader, and Security Reader are sometimes believed to be less important compared to other roles as they don’t have write permission. However, we have seen some customers also protect these roles because attackers who have gained access to these accounts may be able to read sensitive data, such as personally identifiable information (PII). You should take this into consideration when deciding whether reader roles in your organization need to be managed using Privileged Identity Management.
196
+
Reader roles like the Directory Reader, Message Center Reader, and Security Reader are sometimes believed to be less important compared to other roles as they don’t have write permission. However, we have seen some customers also protect these roles because attackers who have gained access to these accounts may be able to read sensitive data, such as personal data. You should take this into consideration when deciding whether reader roles in your organization need to be managed using Privileged Identity Management.
0 commit comments