introduce IGA role

markwahl-msft · markwahl-msft · commit 9939f94e8a9f · 2021-04-21T16:44:35.000-07:00
diff --git a/articles/active-directory/governance/entitlement-management-access-package-approval-policy.md b/articles/active-directory/governance/entitlement-management-access-package-approval-policy.md
@@ -50,7 +50,7 @@ For a demonstration of how to add a multi-stage approval to a request policy, wa
 
 Follow these steps to specify the approval settings for requests for the access package:
 
-**Prerequisite role:** Global administrator, User administrator, Catalog owner, or Access package manager
+**Prerequisite role:** Global administrator, Identity Governance administrator, User administrator, Catalog owner, or Access package manager
 
 1. In the Azure portal, click **Azure Active Directory** and then click **Identity Governance**.
 
diff --git a/articles/active-directory/governance/entitlement-management-access-package-assignments.md b/articles/active-directory/governance/entitlement-management-access-package-assignments.md
@@ -34,7 +34,7 @@ To use Azure AD entitlement management and assign users to access packages, you
 
 ## View who has an assignment
 
-**Prerequisite role:** Global administrator, User administrator, Catalog owner, Access package manager or Access package assignment manager
+**Prerequisite role:** Global administrator, Identity Governance administrator, User administrator, Catalog owner, Access package manager or Access package assignment manager
 
 1. In the Azure portal, click **Azure Active Directory** and then click **Identity Governance**.
 
diff --git a/articles/active-directory/governance/entitlement-management-access-package-create.md b/articles/active-directory/governance/entitlement-management-access-package-create.md
@@ -53,7 +53,7 @@ Here are the high-level steps to create a new access package.
 
 ## Start new access package
 
-**Prerequisite role:** Global administrator, User administrator, Catalog owner, or Access package manager
+**Prerequisite role:** Global administrator, Identity Governance administrator, User administrator, Catalog owner, or Access package manager
 
 1. Sign in to the [Azure portal](https://portal.azure.com).
 
@@ -73,11 +73,11 @@ On the **Basics** tab, you give the access package a name and specify which cata
 
 1. In the **Catalog** drop-down list, select the catalog you want to create the access package in. For example, you might have a catalog owner that manages all the marketing resources that can be requested. In this case, you could select the marketing catalog.
 
-    You will only see catalogs you have permission to create access packages in. To create an access package in an existing catalog, you must be a Global administrator or User administrator, or you must be a catalog owner or access package manager in that catalog.
+    You will only see catalogs you have permission to create access packages in. To create an access package in an existing catalog, you must be a Global administrator, Identity Governance administrator or User administrator, or you must be a catalog owner or access package manager in that catalog.
 
     ![Access package - Basics](./media/entitlement-management-access-package-create/basics.png)
 
-    If you are a Global administrator, a User administrator, or catalog creator and you would like to create your access package in a new catalog that's not listed, click **Create new catalog**. Enter the Catalog name and description and then click **Create**.
+    If you are a Global administrator, an Identity Governance administrator, a User administrator, or catalog creator and you would like to create your access package in a new catalog that's not listed, click **Create new catalog**. Enter the Catalog name and description and then click **Create**.
 
     The access package you are creating and any resources included in it will be added to the new catalog. You can also  add additional catalog owners later.
 
diff --git a/articles/active-directory/governance/entitlement-management-access-package-edit.md b/articles/active-directory/governance/entitlement-management-access-package-edit.md
@@ -31,7 +31,7 @@ This article describes how to hide or delete an access package.
 
 Follow these steps to change the **Hidden** setting for an access package.
 
-**Prerequisite role:** Global administrator, User administrator, Catalog owner, or Access package manager
+**Prerequisite role:** Global administrator, Identity Governance administrator, User administrator, Catalog owner, or Access package manager
 
 1. In the Azure portal, click **Azure Active Directory** and then click **Identity Governance**.
 
diff --git a/articles/active-directory/governance/entitlement-management-access-package-first.md b/articles/active-directory/governance/entitlement-management-access-package-first.md
@@ -76,7 +76,7 @@ A resource directory has one or more resources to share. In this step, you creat
 
 An *access package* is a bundle of resources that a team or project needs and is governed with policies. Access packages are defined in containers called *catalogs*. In this step, you create a **Marketing Campaign** access package in the **General** catalog.
 
-**Prerequisite role:** Global administrator, User administrator, Catalog owner, or Access package manager
+**Prerequisite role:** Global administrator, Identity Governance administrator, User administrator, Catalog owner, or Access package manager
 
 ![Create an access package](./media/entitlement-management-access-package-first/elm-access-package.png)
 
diff --git a/articles/active-directory/governance/entitlement-management-access-package-lifecycle-policy.md b/articles/active-directory/governance/entitlement-management-access-package-lifecycle-policy.md
@@ -34,7 +34,7 @@ To ensure users have the right access to an access package, custom questions can
 
 To change the lifecycle settings for an access package, you need to open the corresponding policy. Follow these steps to open the lifecycle settings for an access package.
 
-**Prerequisite role:** Global administrator, User administrator, Catalog owner, or Access package manager
+**Prerequisite role:** Global administrator, Identity Governance administrator, User administrator, Catalog owner, or Access package manager
 
 1. In the Azure portal, click **Azure Active Directory** and then click **Identity Governance**.
 
diff --git a/articles/active-directory/governance/entitlement-management-access-package-request-policy.md b/articles/active-directory/governance/entitlement-management-access-package-request-policy.md
@@ -52,7 +52,7 @@ For information about the priority logic that is used when multiple policies app
 
 If you have a set of users that should have different request and approval settings, you'll likely need to create a new policy. Follow these steps to start adding a new policy to an existing access package:
 
-**Prerequisite role:** Global administrator, User administrator, Catalog owner, or Access package manager
+**Prerequisite role:** Global administrator, Identity Governance administrator, User administrator, Catalog owner, or Access package manager
 
 1. In the Azure portal, click **Azure Active Directory** and then click **Identity Governance**.
 
diff --git a/articles/active-directory/governance/entitlement-management-access-package-requests.md b/articles/active-directory/governance/entitlement-management-access-package-requests.md
@@ -27,7 +27,7 @@ In Azure AD entitlement management, you can see who has requested access package
 
 ## View requests
 
-**Prerequisite role:** Global administrator, User administrator, Catalog owner, Access package manager or Access package assignment manager
+**Prerequisite role:** Global administrator, Identity Governance administrator, User administrator, Catalog owner, Access package manager or Access package assignment manager
 
 1. In the Azure portal, click **Azure Active Directory** and then click **Identity Governance**.
 
diff --git a/articles/active-directory/governance/entitlement-management-access-package-resources.md b/articles/active-directory/governance/entitlement-management-access-package-resources.md
@@ -33,7 +33,7 @@ This video provides an overview of how to change an access package.
 
 If you need to add resources to an access package, you should check whether the resources your need are available in the catalog. If you are an access package manager, you cannot add resources to a catalog, even if you own them. You are restricted to using the resources available in the catalog.
 
-**Prerequisite role:** Global administrator, User administrator, Catalog owner, or Access package manager
+**Prerequisite role:** Global administrator, Identity Governance administrator, User administrator, Catalog owner, or Access package manager
 
 1. In the Azure portal, click **Azure Active Directory** and then click **Identity Governance**.
 
diff --git a/articles/active-directory/governance/entitlement-management-access-package-settings.md b/articles/active-directory/governance/entitlement-management-access-package-settings.md
@@ -29,7 +29,7 @@ As long as the catalog for the access package is [enabled for external users](en
 
 ## Share link to request an access package
 
-**Prerequisite role:** Global administrator, User administrator, Catalog owner, or Access package manager
+**Prerequisite role:** Global administrator, Identity Governance administrator, User administrator, Catalog owner, or Access package manager
 
 1. In the Azure portal, click **Azure Active Directory** and then click **Identity Governance**.
 
diff --git a/articles/active-directory/governance/entitlement-management-access-reviews-create.md b/articles/active-directory/governance/entitlement-management-access-reviews-create.md
@@ -29,7 +29,7 @@ To reduce the risk of stale access, you should enable periodic reviews of users
 
 To enable reviews of access packages, you must meet the prerequisites for creating an access package:
 - Azure AD Premium P2
-- Global administrator, User administrator, Catalog owner, or Access package manager
+- Global administrator, Identity Governance administrator, User administrator, Catalog owner, or Access package manager
 
 For more information, see [License requirements](entitlement-management-overview.md#license-requirements).
 
diff --git a/articles/active-directory/governance/entitlement-management-access-reviews-review-access.md b/articles/active-directory/governance/entitlement-management-access-reviews-review-access.md
@@ -29,8 +29,7 @@ Azure AD entitlement management simplifies how enterprises manage access to grou
 
 To review users' active access package assignments, you must meet the prerequisites to do an access review:
 - Azure AD Premium P2
-- Global administrator
-- Designated User administrator, Catalog owner, or Access package manager
+- Global administrator, Identity Governance administrator, User administrator, Catalog owner, or Access package manager
 
 For more information, see [License requirements](entitlement-management-overview.md#license-requirements).
 
diff --git a/articles/active-directory/governance/entitlement-management-catalog-create.md b/articles/active-directory/governance/entitlement-management-catalog-create.md
@@ -27,7 +27,7 @@ ms.collection: M365-identity-device-management
 
 A catalog is a container of resources and access packages. You create a catalog when you want to group related resources and access packages. Whoever creates the catalog becomes the first catalog owner. A catalog owner can add additional catalog owners.
 
-**Prerequisite role:** Global administrator, User administrator, or Catalog creator
+**Prerequisite role:** Global administrator, Identity Governance administrator, User administrator, or Catalog creator
 
 1. In the Azure portal, click **Azure Active Directory** and then click **Identity Governance**.
 
@@ -114,7 +114,7 @@ The user that created a catalog becomes the first catalog owner. To delegate man
 
 Follow these steps to assign a user to the catalog owner role:
 
-**Prerequisite role:** Global administrator, User administrator, or Catalog owner
+**Prerequisite role:** Global administrator, Identity Governance administrator, User administrator, or Catalog owner
 
 1. In the Azure portal, click **Azure Active Directory** and then click **Identity Governance**.
 
@@ -132,7 +132,7 @@ Follow these steps to assign a user to the catalog owner role:
 
 You can edit the name and description for a catalog. Users see this information in an access package's details.
 
-**Prerequisite role:** Global administrator, User administrator, or Catalog owner
+**Prerequisite role:** Global administrator, Identity Governance administrator, User administrator, or Catalog owner
 
 1. In the Azure portal, click **Azure Active Directory** and then click **Identity Governance**.
 
@@ -150,7 +150,7 @@ You can edit the name and description for a catalog. Users see this information
 
 You can delete a catalog, but only if it does not have any access packages.
 
-**Prerequisite role:** Global administrator, User administrator, or Catalog owner
+**Prerequisite role:** Global administrator, Identity Governance administrator, User administrator, or Catalog owner
 
 1. In the Azure portal, click **Azure Active Directory** and then click **Identity Governance**.
 
diff --git a/articles/active-directory/governance/entitlement-management-delegate-catalog.md b/articles/active-directory/governance/entitlement-management-delegate-catalog.md
@@ -32,7 +32,7 @@ To delegate to users who aren't administrators, so that they can create their ow
 
 Follow these steps to assign a user to the catalog creator role.
 
-**Prerequisite role:** Global administrator or User administrator
+**Prerequisite role:** Global administrator, Identity Governance administrator or User administrator
 
 1. In the Azure portal, click **Azure Active Directory** and then click **Identity Governance**.
 
diff --git a/articles/active-directory/governance/entitlement-management-delegate-managers.md b/articles/active-directory/governance/entitlement-management-delegate-managers.md
@@ -39,7 +39,7 @@ This video provides an overview of how to delegate access governance from catalo
 
 Follow these steps to assign a user to the access package manager role:
 
-**Prerequisite role:** Global administrator, User administrator, or Catalog owner
+**Prerequisite role:** Global administrator, Identity Governance administrator, User administrator, or Catalog owner
 
 1. In the Azure portal, click **Azure Active Directory** and then click **Identity Governance**.
 
diff --git a/articles/active-directory/governance/entitlement-management-delegate.md b/articles/active-directory/governance/entitlement-management-delegate.md
@@ -64,7 +64,7 @@ After delegation, the marketing department might have roles similar to the follo
 
 | User | Job role | Azure AD role | Entitlement management role |
 | --- | --- | --- | --- |
-| Hana | IT administrator | Global administrator or User administrator |  |
+| Hana | IT administrator | Global administrator, Identity Governance administrator or User administrator |  |
 | Mamta | Marketing manager | User | Catalog creator and Catalog owner |
 | Bob | Marketing lead | User | Catalog owner |
 | Jessica | Marketing project manager | User | Access package manager |
diff --git a/articles/active-directory/governance/entitlement-management-external-users.md b/articles/active-directory/governance/entitlement-management-external-users.md
@@ -118,7 +118,7 @@ To ensure people outside of your organization can request access packages and ge
 
 You can select what happens when an external user, who was invited to your directory through an access package request being approved, no longer has any access package assignments. This can happen if the user relinquishes all their access package assignments, or their last access package assignment expires. By default, when an external user no longer has any access package assignments, they are blocked from signing in to your directory. After 30 days, their guest user account is removed from your directory.
 
-**Prerequisite role:** Global administrator or User administrator
+**Prerequisite role:** Global administrator, Identity Governance administrator or User administrator
 
 1. In the Azure portal, click **Azure Active Directory** and then click **Identity Governance**.
 
diff --git a/articles/active-directory/governance/entitlement-management-organization.md b/articles/active-directory/governance/entitlement-management-organization.md
@@ -59,7 +59,7 @@ For a demonstration of how to add a connected organization, watch the following
 
 To add an external Azure AD directory or domain as a connected organization, follow the instructions in this section.
 
-**Prerequisite role**: *Global administrator* or *User administrator*
+**Prerequisite role**: *Global administrator*, *Identity Governance administrator*,  or *User administrator*
 
 1. In the Azure portal, select **Azure Active Directory**, and then select **Identity Governance**.
 
diff --git a/articles/active-directory/governance/entitlement-management-reports.md b/articles/active-directory/governance/entitlement-management-reports.md
@@ -34,7 +34,7 @@ Watch the following video to learn how to view what resources users have access
 
 This report enables you to list all of the access packages a user can request and the access packages that are currently assigned to the user.
 
-**Prerequisite role:** Global administrator or User administrator
+**Prerequisite role:** Global administrator, Identity Governance administrator or User administrator
 
 1. Click **Azure Active Directory** and then click **Identity Governance**.
 
@@ -58,7 +58,7 @@ This report enables you to list all of the access packages a user can request an
 
 This report enables you to list the resources currently assigned to a user in entitlement management. Note that this report is for resources managed with entitlement management. The user might have access to other resources in your directory outside of entitlement management.
 
-**Prerequisite role:** Global administrator or User administrator
+**Prerequisite role:** Global administrator, Identity Governance administrator or User administrator
 
 1. Click **Azure Active Directory** and then click **Identity Governance**.
 
diff --git a/articles/active-directory/governance/entitlement-management-troubleshoot.md b/articles/active-directory/governance/entitlement-management-troubleshoot.md
@@ -72,7 +72,7 @@ This article describes some items you should check to help you troubleshoot Azur
 
 ### View a request's delivery errors
 
-**Prerequisite role:** Global administrator, User administrator, Catalog owner, Access package manager or Access package assignment manager
+**Prerequisite role:** Global administrator, Identity Governance administrator, User administrator, Catalog owner, Access package manager or Access package assignment manager
 
 1. In the Azure portal, click **Azure Active Directory** and then click **Identity Governance**.
 
@@ -100,7 +100,7 @@ You can only reprocess a request that has a status of **Delivery failed** or **P
 
 - If the error wasn't fixed during the trials window, the request status may be **Delivery failed** or **partially delivered**. You can then use the **reprocess** button. You'll have seven days to reprocess the request.
 
-**Prerequisite role:** Global administrator, User administrator, Catalog owner, Access package manager or Access package assignment manager
+**Prerequisite role:** Global administrator, Identity Governance administrator, User administrator, Catalog owner, Access package manager or Access package assignment manager
 
 1. In the Azure portal, click **Azure Active Directory** and then click **Identity Governance**.
 
@@ -118,7 +118,7 @@ You can only reprocess a request that has a status of **Delivery failed** or **P
 
 You can only cancel a pending request that has not yet been delivered or whose delivery has failed.The **cancel** button would be grayed out otherwise.
 
-**Prerequisite role:** Global administrator, User administrator, Catalog owner, Access package manager or Access package assignment manager
+**Prerequisite role:** Global administrator, Identity Governance administrator, User administrator, Catalog owner, Access package manager or Access package assignment manager
 
 1. In the Azure portal, click **Azure Active Directory** and then click **Identity Governance**.
 
diff --git a/articles/active-directory/governance/identity-governance-overview.md b/articles/active-directory/governance/identity-governance-overview.md
@@ -108,6 +108,9 @@ It's a best practice to use the least privileged role to perform administrative
 |Privileged Identity Management | Privileged role administrator |
 | Terms of use | Security administrator or Conditional access administrator |
 
+>[!NOTE]
+>The least privileged role for Entitlement management will be changing from the User Administrator role to the Identity Governance Administrator role.
+
 ## Next steps
 
 - [What is Azure AD entitlement management?](entitlement-management-overview.md)
