System Roles IM Demo

When most of us think about an application like this Microsoft 365 application on the onelogin dashboard, we tend to think of it as just one thing. If I click this tile, it will launch Microsoft 365 in a new browser tab. And from there, I can do things like edit a document or check my email. But behind the scenes, this application actually represents a number of different things. First of all, there's a onelogin account and the assignment of the application to the user's launchpad. Since the SSO and MFA access management platform offers the first layer of security for your organization, it's critical to govern what applications users have access to. So your access management portal must be included in your security plan. Microsoft 365 also requires an Azure AD account for the user, which itself has specific requirements for it to work correctly, such as domain configuration, OUs, containers, additional group memberships, et cetera. It includes a license for the applications, which is an entitlement on that Azure AD account, and other entitlement for the Microsoft service plan. Most enterprises also have an on-premise active directory domain linked to their Azure AD. And therefore, this will require an AD account, which has many of its own entitlements, along with group memberships often used for accounting of the office applications. All of these things together really comprise one unit of access. And since many different items are needed for effective access, they can be difficult for a business user to really understand. The business user just needs to edit a Word doc. Why should they be concerned about which of the nearly 2,500 Microsoft service plan sub-SKUs they need in order to do this? This is just one example. But nearly all enterprise applications actually require multiple different items in order to constitute secure and governable access to the application. Identity Manager uses system roles to create a single access object that includes all of the accounts and entitlements that are needed to create effective access for the application or system. And with the application governance feature, Identity Manager enables business users as well as IT admins to manage applications and their system role assignment, including publishing them to the IT Shop so users can request them. This relieves the IT organization of some of the burden of managing applications since department managers and team leaders can directly add applications they need. When a user is assigned access to this application, such as with an access request, they only have to know about the one application, which makes sense to them as business user. Identity Manager will effectively enable all of the required access, accounts, entitlements, or other items that are needed in order for this application to work. And these team leaders can also add the application to their department's business roles, which helps them organically grow your role-based access without any burden on the IT organization besides approving the changes. When an access review is done, the manager doing the review doesn't have to know the technical details of all the elements that make up access to this application but can approve or reject it based on the whole application. Identity Manager will remediate access to all of the affected items. This is critical because to simply remove the application from the user's SSO launchpad and leave the associated accounts and entitlements in place would create a potential vulnerability.