You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: articles/active-directory/cloud-infrastructure-entitlement-management/cloudknox-product-account-explorer.md
+24-37Lines changed: 24 additions & 37 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -16,7 +16,7 @@ ms.author: v-ydequadros
16
16
> CloudKnox Permissions Management (CloudKnox) is currently in PREVIEW.
17
17
> Some information relates to a prerelease product that may be substantially modified before it's released. Microsoft makes no warranties, express or implied, with respect to the information provided here.
18
18
19
-
You can view information about users, groups, and resources that can access account information from an external account in CloudKnox Permissions Management (CloudKnox).
19
+
You can view information about users, groups, and resources that can access account information from an external account in CloudKnox Permissions Management (CloudKnox).
20
20
21
21
## Display information about users, groups, or tasks
22
22
@@ -31,61 +31,48 @@ You can view information about users, groups, and resources that can access acc
31
31
32
32
1. To choose an account from your authorization system, select the lock icon in the left panel.
33
33
1. In the **Authorization systems** pane, select an account, then select **Apply**.
34
-
35
34
1. To choose a user, role, or group, select the person icon.
36
35
1. Select a user or group, then select **Apply**.
37
-
38
-
1.To choose a task, select the clipboard icon.
39
-
1. In the **Task**pane, select **All** or **High-risk tasks**, then select **Apply**.
36
+
1. To choose an account from your authorization system, select it from the Authorization Systems menu.
37
+
1.In the user type filter, user, role, or group.
38
+
1. In the **Task**filter, select **All** or **High-risk tasks**, then select **Apply**.
40
39
1. To delete a task, select **Delete**, then select **Apply**.
41
40
42
-
43
41
## Export information about users, groups, or tasks
44
42
45
-
-To export the data in comma-separated values (CSV) file format, in the **User analytics**dashboard, Click **Export** and selet **CSV**.
43
+
To export the data in comma-separated values (CSV) file format, select **Export**from the top-right hand corner of the table.
46
44
47
45
## View users and roles
48
-
49
46
1. To view users and roles, select the lock icon, and then select the person icon to open the **Users** pane.
47
+
1. To view the **Role summary**, select the "eye" icon to the right of the role name.
50
48
51
-
1. To view the **Role summary**, select the "eye" icon to the right of the role name.
52
-
53
-
The following details display:
54
-
55
-
-**Policies**: A list of all the policies attached to the role.
56
-
-**Trusted entities**: The identities from external accounts that can assume this role.
49
+
The following details display:
50
+
-**Policies**: A list of all the policies attached to the role.
51
+
-**Trusted entities**: The identities from external accounts that can assume this role.
57
52
58
53
1. To view all the identities from various accounts that can assume this role, select the down arrow to the left of the role name.
54
+
1. To view a graph of all the identities that can access the specified account and through which role(s), select the role name.
59
55
60
-
1. To view a graph of all the identities that can access the specified account and through which role(s), select the role name.
61
-
62
-
If CloudKnox is monitoring the external account, it lists specific identities from the accounts that can assume this role. Otherwise, it lists the identities declared in the **Trusted entity** section.
56
+
If CloudKnox is monitoring the external account, it lists specific identities from the accounts that can assume this role. Otherwise, it lists the identities declared in the **Trusted entity** section.
63
57
64
-
-**Connecting roles**: Lists the following roles for each account:
65
-
66
-
- *Direct roles* that are trusted by the account role.
67
-
- *Intermediary roles* that aren't directly trusted by the account role but are assumable by identities through role-chaining.
58
+
**Connecting roles**: Lists the following roles for each account:
59
+
-*Direct roles* that are trusted by the account role.
60
+
-*Intermediary roles* that aren't directly trusted by the account role but are assumable by identities through role-chaining.
68
61
69
62
1. To view all the roles from that account that are used to access the specified account, select the down arrow to the left of the account name.
63
+
1. To view the trusted identities declared by the role, select the down arrow to the left of the role name.
70
64
71
-
1. To view the trusted identities declared by the role, select the down arrow to the left of the role name.
72
-
73
-
The trusted identities for the role are listed only if the account is being monitored by CloudKnox.
74
-
75
-
1. To view the role definition, select the "eye" icon to the right of the role name.
76
-
77
-
When you select the down arrow and expand details, a search box is displayed. Enter your criteria in this box to search for specific roles.
78
-
79
-
-**Identities with access**: Lists the identities that come from external accounts:
80
-
81
-
- To view all the identities from that account can access the specified account, select the down arrow to the left of the account name.
82
-
- To view the **Role summary** for EC2 instances and Lambda functions, select the "eye" icon to the right of the identity name.
83
-
- To view a graph of how the identity can access the specified account and through which role(s), select the identity name.
65
+
The trusted identities for the role are listed only if the account is being monitored by CloudKnox.
84
66
85
-
1.The **Info** tab displays the **Privilege creep index** and **Service control policy (SCP)** information about the account.
67
+
1.To view the role definition, select the "eye" icon to the right of the role name.
86
68
87
-
For more information about the **Privilege creep index** and SCP information, see [View key statistics and data about your authorization system](cloudknox-ui-dashboard.md).
69
+
When you select the down arrow and expand details, a search box is displayed. Enter your criteria in this box to search for specific roles.
88
70
89
-
<!---## Next steps--->
71
+
**Identities with access**: Lists the identities that come from external accounts:
72
+
- To view all the identities from that account can access the specified account, select the down arrow to the left of the account name.
73
+
- To view the **Role summary** for EC2 instances and Lambda functions, select the "eye" icon to the right of the identity name.
74
+
- To view a graph of how the identity can access the specified account and through which role(s), select the identity name.
90
75
76
+
1. The **Info** tab displays the **Privilege creep index** and **Service control policy (SCP)** information about the account.
91
77
78
+
For more information about the **Privilege creep index** and SCP information, see [View key statistics and data about your authorization system](cloudknox-ui-dashboard.md).
Copy file name to clipboardExpand all lines: articles/active-directory/cloud-infrastructure-entitlement-management/cloudknox-product-rule-based-anomalies.md
- To view the specific identity, resource, and task names that occurred during the alert collection period, select the **Alert Name**.
32
+
- To view the specific identity, resource, and task names that occurred during the alert collection period, select the **Alert Name**.
33
33
34
34
-**Anomaly alert rule**: Displays the name of the rule select when creating the alert.
35
35
-**# of occurrences**: How many times the alert trigger has occurred.
36
-
-**Task**: How many tasks are affected by the alert.
37
-
-**Resources**: How many resources are affected by the alert.
38
-
-**Identity**: How many identities are affected by the alert.
36
+
-**Task**: How many tasks performed are triggered by the alert.
37
+
-**Resources**: How many resources accessed are triggered by the alert.
38
+
-**Identity**: How many identities performing unusual behavior are triggered by the alert.
39
39
-**Authorization system**: Displays which authorization systems the alert applies to, Amazon Web Services (**AWS**), Microsoft **Azure**, or Google Cloud Platform (**GCP**).
40
40
-**Date/Time**: Lists the date and time of the alert.
41
41
-**Date/Time (UTC)**: Lists the date and time of the alert in Coordinated Universal Time (UTC).
42
-
-**View trigger**: Displays the current trigger settings and applicable authorization system details.
43
-
-**Activity**: Displays details about the **Identity Name**, **Resource Name**, **Task Name**, **Date**, and **IP Address**.
42
+
44
43
45
44
1. To filter alerts:
46
45
47
46
- From the **Alert Name** dropdown, select **All** or the appropriate alert name.
48
47
- From the **Date** dropdown menu, select **Last 24 Hours**, **Last 2 Days**, **Last Week**, or **Custom Range**, and select **Apply**.
49
48
50
-
- If you select **Custom Range**, also enter **From** and **To** duration settings.
49
+
- If you select **Custom Range**, also enter **From** and **To** duration settings.
51
50
1. To view details that match the alert criteria, select the ellipses (**...**).
52
51
53
-
For example, **Authorization System Type**, **Authorization Systems**, **Resources**, **Tasks**, and **Identities**.
52
+
-**View Trigger**: Displays the current trigger settings and applicable authorization system details
53
+
-**Details**: Displays details about **Authorization System Type**, **Authorization Systems**, **Resources**, **Tasks**, **Identities**, and **Activity**
54
+
-**Activity**: Displays details about the **Identity Name**, **Resource Name**, **Task Name**, **Date/Time**, **Inactive For**, and **IP Address**. Selecting the "eye" icon displays the **Raw Events Summary**
-**Any Resource Accessed for the First Time**: The identity accesses a resource for the first time during the specified time interval.
65
66
-**Identity Performs a Particular Task for the First Time**: The identity does a specific task for the first time during the specified time interval.
66
-
-**Inactive Identity Becomes Active**: An identity that hasn't been active for 90 days becomes active and does any task in the selected time interval.
67
+
-**Identity Performs a Task for the First Time**: The identity performs any task for the first time during the specified time interval
67
68
1. Select **Next**.
68
-
1. On the **Authorization systems** tab, select the available authorization systems accounts and folders, or select **All**.
69
+
1. On the **Authorization Systems** tab, select the available authorization systems and folders, or select **All**.
69
70
70
-
This screen defaults to **List** view, but you can change it to **Folder** view. You can select the applicable folder instead of individually by system.
71
+
This screen defaults to **List** view, but you can change it to **Folders** view. You can select the applicable folder instead of individually selecting by authorization system.
71
72
72
73
- The **Status** column displays if the authorization system is online or offline.
73
74
- The **Controller** column displays if the controller is enabled or disabled.
Only the user who created the alert can edit the trigger screen, rename an alert, deactivate an alert, and delete an alert. Changes made by other users aren't saved.
101
101
102
-
-**Duplicate**: Create a duplicate of the alert called "**Copy of XXX**".
102
+
-**Duplicate**: Create a duplicate copy of the selected alert trigger.
103
103
-**Rename**: Enter the new name of the query, and then select **Save.**
104
104
-**Deactivate**: The alert will still be listed, but will no longer send emails to subscribed users.
105
105
-**Activate**: Activate the alert trigger and start sending emails to subscribed users.
106
-
-**Notification settings**: View the **Email** of users who are subscribed to the alert trigger and their **User status**.
106
+
-**Notification settings**: View the **Email** of users who are subscribed to the alert trigger.
107
107
-**Delete**: Delete the alert.
108
108
109
109
If the **Subscription** is **Off**, the following options are available:
110
110
-**View**: View details of the alert trigger.
111
-
-**Notification settings**: View the **Email** of users who are subscribed to the alert trigger and their **User status**.
111
+
-**Notification settings**: View the **Email** of users who are subscribed to the alert trigger.
112
112
-**Duplicate**: Create a duplicate copy of the selected alert trigger.
113
113
114
114
1. To filter by **Activated** or **Deactivated**, in the **Status** section, select **All**, **Activated**, or **Deactivated**, and then select **Apply**.
- For an overview on activity triggers, see [View information about activity triggers](cloudknox-ui-triggers.md).
121
121
- For information on activity alerts and alert triggers, see [Create and view activity alerts and alert triggers](cloudknox-howto-create-alert-trigger.md).
122
122
- For information on finding outliers in identity's behavior, see [Create and view statistical anomalies and anomaly triggers](cloudknox-product-statistical-anomalies.md).
123
-
- For information on permission analytics triggers, see [Create and view permission analytics triggers](cloudknox-product-permission-analytics.md).
123
+
- For information on permission analytics triggers, see [Create and view permission analytics triggers](cloudknox-product-permission-analytics.md).
Copy file name to clipboardExpand all lines: articles/active-directory/external-identities/cross-tenant-access-overview.md
+11-6Lines changed: 11 additions & 6 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -5,7 +5,7 @@ services: active-directory
5
5
ms.service: active-directory
6
6
ms.subservice: B2B
7
7
ms.topic: how-to
8
-
ms.date: 02/07/2022
8
+
ms.date: 02/23/2022
9
9
10
10
ms.author: mimart
11
11
author: msmimart
@@ -94,11 +94,16 @@ The output is a summary of all available sign-in events for inbound and outbound
94
94
To determine your users' access to external Azure AD organizations, you can use the [Get-MgAuditLogSignIn](/powershell/module/microsoft.graph.reports/get-mgauditlogsignin) cmdlet in the Microsoft Graph PowerShell SDK to view data from your sign-in logs for the last 30 days. For example, run the following command:
95
95
96
96
```powershell
97
-
Get-MgAuditLogSignIn `
98
-
-Filter “ResourceTenantID ne ‘your tenant id’” `
99
-
-all:$True| `
100
-
group ResourceTenantId,AppDisplayName,UserPrincipalName| `
101
-
select count, @{n=’Ext TenantID/App User Pair’;e={$_.name}}]
97
+
#Initial connection
98
+
Connect-MgGraph -Scopes "AuditLog.Read.All"
99
+
Select-MgProfile -Name "beta"
100
+
101
+
#Get external access
102
+
$TenantId = "<replace-with-your-tenant-ID>"
103
+
104
+
Get-MgAuditLogSignIn -Filter "ResourceTenantId ne '$TenantID'" -All:$True |
Copy file name to clipboardExpand all lines: articles/active-directory/governance/entitlement-management-onboard-external-user.md
+2-2Lines changed: 2 additions & 2 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -3,7 +3,7 @@ title: Tutorial - Onboard external users to Azure AD through an approval process
3
3
description: Step-by-step tutorial for how to create an access package for external users requiring approvals in Azure Active Directory entitlement management.
4
4
services: active-directory
5
5
documentationCenter: ''
6
-
author: sama
6
+
author: Sammak
7
7
ms.service: active-directory
8
8
ms.workload: identity
9
9
ms.tgt_pltfrm: na
@@ -62,7 +62,7 @@ For more information, see [License requirements](entitlement-management-overview
62
62
63
63
2. In the **Users who can request access** section, click **For users not in your directory** and then click **All users (All connected organizations + any new external users)**.
64
64
65
-
3.Ensure that **Require approval** is set to **Yes**.
65
+
3.Because any user who is not yet in your directory can view and submit a request for this access package, **Yes** is mandatory for the **Require approval** setting.
66
66
67
67
4. The following settings allow you to configure how your approvals work for your external users:
Copy file name to clipboardExpand all lines: articles/active-directory/saas-apps/smartsheet-provisioning-tutorial.md
+3-2Lines changed: 3 additions & 2 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -118,7 +118,7 @@ This section guides you through the steps to configure the Azure AD provisioning
118
118
119
119
120
120
121
-
5. Under the **Admin Credentials** section, input the **SCIM 2.0 base URLand Access Token**values retrieved earlier from Smartsheet in **Tenant URL** and **Secret Token** respectively.. Click **Test Connection** to ensure Azure AD can connect to Smartsheet. If the connection fails, ensure your Smartsheet account has SysAdmin permissions and try again.
121
+
5. Under the **Admin Credentials** section, input the **SCIM 2.0 base URL** of https://scim.smartsheet.com/v2and **Access Token**value retrieved earlier from Smartsheet in **Secret Token** respectively. Click **Test Connection** to ensure Azure AD can connect to Smartsheet. If the connection fails, ensure your Smartsheet account has SysAdmin permissions and try again.
Copy file name to clipboardExpand all lines: articles/advisor/resource-graph-samples.md
+1-1Lines changed: 1 addition & 1 deletion
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -1,7 +1,7 @@
1
1
---
2
2
title: Azure Resource Graph sample queries for Azure Advisor
3
3
description: Sample Azure Resource Graph queries for Azure Advisor showing use of resource types and tables to access Azure Advisor related resources and properties.
0 commit comments