u/snow-leapord-1

We have a case where all externals needs to be enrolled in our SaaS Hr system and they eventually get and AD account — synced to Entra as Members but will have no Mailbox - How do we achieve the following

1. We want to have their external email address mentioned in their profile so that emails reach to them. ( external mailbox provided by their own org)
2. Once their account is visible in Entra, we want to make sure that , they are shown in Teams for collaboration
3. They get access to some sharepoint sites and some lion of business apps

We do not want to use azure b2b because this in someway removes the. source of authority, thats why we have them in HR system , b2b kinda bypasses this - creates cloud only accounts and granting access to internal apps to these ( external ids ) accounts is seen as risk by security team.

What can be a possible solution?

Considering you have Entra as your Access Management solution and Okta Identity Governance or Sailpoint as your IGA, how will you architect the solution for long term .

1. Will you integrate all apps to your IGA solution (which also includes AD and Entra ID )

2. Or you provision to Entra and then let entra do all the processing.

But we wana do Access reviews, Role discovery of apps , jml

Entra right now is not fully capable of handling many governance tasks.

What direction you suggest ?

What AI would you use to understand a decade old powershell script written by someone having 1000s of lines and plays a very crucial role for one of the function in an Org , between HR and AD. I would want the AI to explain me core functions , loop holes and maybe a visual representation of how the flow works with various conditions ( if, else and other exceptions ).

As a IAM architect, what Technical tools would you use if there was a big transformation project related to IAM that you are expected to work.

Also what level of information does an architect need to put in when designing a solution ?

for example in an IGA solution, we know usually 1 Source of truth and then there are various target apps that we show for provisining and governance, going beyond this what else needs to be shown ?

Hi Guys,

Experienced people who have worked with PAM solutions ( leaving the entra solution- PIM )
How is license fee calculated.
In a traditional IGA solution it would be per account basis but since for PAM we are talking about privileged accounts which are ideally supposed to be less than normal accounts ( but yes there can be cases where service accounts with high privileges are also counted) , in any case how is license fee calculated?

any inputs?

Hi Fellow Collegaues , What is your opinion about a situation where :

1. There are retail shops or warehouses where employees ( blue collar colleagues ) are working in shifts BUT using a shared account on a shared device.
2. Shared device is company managed ( intune or similar )

Question is :

1. How will you solve audit questions - "Who did what with that shared account" ? If for eg. there are 4 people in a shop using that same shared account to login to the shared device and then to some "order booking" app.

One way is -

1. Skip shared account totally, let them login individually with their own account ( which they use to check their payroll and other fundamental tasks )

This can be thought of, but imagine a case where in a shop you have many "potential" customers wanting to buy something and you have 4-5 employee in that case each employee who gets a hand on that device need to login again everytime to book the order. This will for sure impact the business and revenue in some sense.

2. Another solution is increased the number of device , give all Blue collar colleagues their own indivdual devices, this increases operations, device management and ofcourse cost.

So please advice, what has worked with you..