How can we improve Azure Active Directory?

← Azure Active Directory

Add Manager Option to Reviewers in Access Reviews

Our organization requires Managers to approve access to Applications. Please give the option to require a manager to approve application access via the Access Reviews option.

29 votes
Sign in
(thinking…)
Sign in with: Microsoft
Forgot password?
Create a password
Signed in as (Sign out)
Close
Close

We’ll send you updates on this idea

Justin Long shared this idea  ·   ·  Flag idea as inappropriate…  ·  Admin →

12 comments

Sign in
(thinking…)
Sign in with: Microsoft
Forgot password?
Create a password
Signed in as (Sign out)
Close
Close
Submitting...
An error occurred while saving the comment
  • Anonymous commented  ·   ·  Flag as inappropriate

    I need this because I have accounts that have roles assigned to them but the user accounts do not have email addresses or mailboxes in O365. If I could assign a review to a user's manager then I would populate the Manager attribute of the user account in question. Here's a case in point:

    I have a user account with no elevated privileges that has an email address
    I have separate admin account with say Global Admin rights
    I would make my personal user account the Manager of the elevated privilege account
    I would then setup a review and send the review to the email address of the managing account i.e. the personal account and I would then approve ot deny the access review.

    Also makes the handling of these accounts, from a life-cycle perspective a little easier as I simply disable the direct report account when the warm body account is disabled assuming that the direct report has an attribute the identifies it as an elevated privilege account

  • Anonymous commented  ·   ·  Flag as inappropriate

    " Planned, since 2018, how long does it take to be in the works? "

    PLANNED ·
    ADMIN
    Azure Access Reviews Team (Product Manager, Microsoft Azure) responded · November 05, 2018
    Hi Justin, thanks for the feedback! It will definitely be helpful to have managers as the reviewers, there is a “manager” attribute in AAD’s user profile, but it’s currently a string only. We are working to improve the architecture first, then we can leverage the data to automatically assign managers to be reviewers. If you have any more feedback or questions on this, feel free to comment on this thread or email accessreviews@microsoft.com.

  • Michael Brine commented  ·   ·  Flag as inappropriate

    I am also keen to get an update to this planned feature as current solution requires multiple policies and Dynamic Security groups to achieve a similar effect.

  • Cameron Gocke commented  ·   ·  Flag as inappropriate

    @Justin Long, I think the existing Access Review routine already allows for this doesn't it? You setup an Access Review for an application and schedule it to happen automatically?

Azure Active Directory: Access Reviews

Categories

Feedback and Knowledge Base

(thinking…)
Hosted by UserVoice