Add Manager Option to Reviewers in Access Reviews
Our organization requires Managers to approve access to Applications. Please give the option to require a manager to approve application access via the Access Reviews option.
Justin Long
shared this idea
Hi Justin, thanks for the feedback! It will definitely be helpful to have managers as the reviewers, there is a “manager” attribute in AAD’s user profile, but it’s currently a string only. We are working to improve the architecture first, then we can leverage the data to automatically assign managers to be reviewers. If you have any more feedback or questions on this, feel free to comment on this thread or email accessreviews@microsoft.com.
7 comments
-
Anonymous
commented
I need this because I have accounts that have roles assigned to them but the user accounts do not have email addresses or mailboxes in O365. If I could assign a review to a user's manager then I would populate the Manager attribute of the user account in question. Here's a case in point:
I have a user account with no elevated privileges that has an email address
I have separate admin account with say Global Admin rights
I would make my personal user account the Manager of the elevated privilege account
I would then setup a review and send the review to the email address of the managing account i.e. the personal account and I would then approve ot deny the access review.Also makes the handling of these accounts, from a life-cycle perspective a little easier as I simply disable the direct report account when the warm body account is disabled assuming that the direct report has an attribute the identifies it as an elevated privilege account
-
Anonymous
commented
" Planned, since 2018, how long does it take to be in the works? "
PLANNED ·
ADMIN
Azure Access Reviews Team (Product Manager, Microsoft Azure) responded · November 05, 2018
Hi Justin, thanks for the feedback! It will definitely be helpful to have managers as the reviewers, there is a “manager” attribute in AAD’s user profile, but it’s currently a string only. We are working to improve the architecture first, then we can leverage the data to automatically assign managers to be reviewers. If you have any more feedback or questions on this, feel free to comment on this thread or email accessreviews@microsoft.com. -
Michael Brine
commented
I am also keen to get an update to this planned feature as current solution requires multiple policies and Dynamic Security groups to achieve a similar effect.
-
Darren
commented
Is there any update on this?
-
Gordon
commented
That will be awesome if supported Manager as reviewers.
-
mike baugh
commented
We also need this feature
-
Cameron Gocke
commented
@Justin Long, I think the existing Access Review routine already allows for this doesn't it? You setup an Access Review for an application and schedule it to happen automatically?