User Provisioning. Joiner, Mover, Leaver Protected Networks GmbH

Transcription

1 User Provisioning Joiner, Mover, Leaver Protected Networks GmbH

2 User Provisioning as a process: joiner, mover & leaver The flexibility of today s working world requires a well thought through user provisioning process. Whether short term appointments, changes of department or temporary project employees, the expectations of the IT department are immense. IT departments are responsible for securing your network, managing access to resources and keeping an overview of permissions and access rights policies. Protected Networks GmbH designates the user provisioning process into three phases: joiners, movers and leavers, allowing for efficient processes and bespoke solutions. When analyzing the roles involved in our provisioning model, you will notice, that the administrator only fills a supervisory role within the process. This is explicitly desired by many of our customers, since modern Administrators have become more like project managers. Like any leadership role, they are thankful for any standard processes that can be efficiently delegated within their organization. Would you like to schedule a bespoke consulting session regarding the 8MAN implementation in your organization? Please contact our experienced systems engineers for more information. Berlin im June 2017 Publisher Protected Networks GmbH Alt-Moabit Berlin Germany Protected-Networks.com 8MAN.com Support helpdesk@8man.com Knowledge Base Knowledge Management Fabian Fischer / Jörg Brandt T: T: Feedback? Stephan Brack Matthias Schulte-Huxel CEO Protected Networks CSO Protected Networks

3 Liability Notice Information provided in this document may change at any given time and without prior notice. Its provision does not entail any kind of legal obligation at Protected Networks s end. The usage of Protected Networks s software 8MAN is outlined in an End User Licence Agreement (EULA). 8MAN must only be used in accordance with its stipulations. Without prior written consent from Protected Networks this document must not be partially or entirely reproduced, transmitted or translated, be it by electronic, mechanical, manual or optical means. This document should be considered part of a framework consisting of Protected Networks s Terms & Conditions, EULA and Privacy Statement to be found on their website. Copyright 8MAN is the registered trademark of a software solution and its related documents and is the intellectual property of Protected Networks. Protected Networks GmbH Alt-Moabit Berlin Berlin, May 2017 Berlin June 2017

4 Content 1 Process overview The Joiner - Phase HR Department GrantMA: Allowing HR employees to request user account creation from the helpdesk... 9 The Help Desk Creating a mailbox ( enable users) Managing addresses Changing mailbox permissions Managing out of office notices Managing mailbox and size The Management of distribution groups Managing distribution group memberships Managing distribution group permissions Changing the moderation of distribution groups Changing the manager of distribution groups Management (Data Owner) Managing SharePoint permissions Changing folder permissions The Mover - Phase Management (Data Owner) Employee Data Owner: Recertification of existing access rights Requesting file server access rights from Data Owners Help Desk Moving objects in Active Directory Modifying group and user attributes Resetting passwords Unlocking user accounts The Leaver - Phase Helpdesk Deactivating a user account Deleting a user account by using the "soft delete" feature Removing a user and their permissions... 58

5 Index Protected Networks GmbH

6 1. Process overview

7 Process overview 7 The Joiner phase: The joiner phase encompasses the onboarding-process. How quickly can user and account be generated? Has the correct user information been entered? Has the employee been added to all mailing lists? Does the new employee have all of his contacts on his company phone? The joiner phase also shows the new employee how professional and organized his new employer s IT department is. Mistakes can be very expensive and wreak havoc on collaboration with partner organizations or related merger activities. The integration of additional domain or OU information can also be negatively affected. 8MANs role and process optimized workflow allows the trigger for new user creation to be set by the HR department. Help Desk only has to check and approve the requested changes. 8Man utilizes templates, which can be defined by IT and Administrators, in order to maintain the overall permissions concept. Depending on the defined role, new employees will receive a batch of basic permissions. Any additional permissions on file servers and SharePoint can be granted by the responsible managers. These socalled Data Owners control the field of play for their employees thereby ensuring that each role is fit for purpose. The mover phase: 8MAN is a very agile and efficient solution, besting even complex IDM systems in scenarios with wideranging and complex organizational changes. If an employee switches departments, the data owner can simply revoke their access rights. At the latest this will happen during the periodic recertification process of all access rights. The new manager receives a new employee with only basic permissions and can then provide the appropriate access rights for that specific role themselves. If the employee requires additional access rights beyond their new department, they can be easily requested from the appropriate data owner via the 8MATE GrantMA self-service Portal. The user account is managed by help desk during the entire user lifecycle. For location changes he can simply change the OU of the user account or make changes to attributes when modifying name or address information. In addition, 8MAN also helps you manage typical tasks such as password resetting or unlocking accounts. The leaver phase: When the employee leaves the organization, HR informs help desk. Help desk can then decommission the user by using the soft delete (for example during parental leave) or by irrevocably deleting it Protected Networks GmbH

8 2. The Joiner - Phase

9 The Joiner - Phase 2.1 HR Department GrantMA: Allowing HR employees to request user account creation from the helpdesk Background / Value The 8MATE GrantMA self-service portal allows HR employees to create user accounts for new employees. Instead of sending user information to IT, the entry and creation of a new user account are combined into one simple step. IT simply has to approve the request. This process is especially useful for departments with high employee turnover and/or a project oriented approach. Step by step process 1. Enter your user name and password. 2. Click on "Login" Protected Networks GmbH 9

10 10 User Provisioning Click on "New Request". Select "new user" and click on "Request".

11 The Joiner - Phase 11 Enter the relevant information for the new user. Fields indicated in red are mandatory or contain invalid entries. After entering all required information click on "Add to shopping cart" Protected Networks GmbH

12 12 User Provisioning Add additional resources if desired. Click on "Order Basket". 1. You can delete an order entry. 2. You must enter a comment. 3. Start the order.

13 The Joiner - Phase Select "My Requests" to view all requests. 2. Filter by "Open". 3. You can see which approvals are next in line. 4. View additional details. 5. Resend a notification to the approver. 6. Cancel your order Protected Networks GmbH

14 14 User Provisioning 2.2 The Help Desk Creating a mailbox ( enable users) Background / Value If your license agreement includes 8MATE for Exchange you can create Mailboxes ( enable users) with 8MAN. Step by step process 1. Select the desired User or distribution group (type: universal). 2. Right-click on the user. You can do this in the Accounts view. 3. Click on "Enable mailbox" from the context menu. This option is only available if no mailbox has been created yet. 1. Determine the Exchange options. 2. You must enter a comment, for example a ticket number. 3. Start the creation of the mailbox.

15 The Joiner - Phase Managing addresses Background / Value With 8MAN you can assign and remove multiple addresses to mailboxes, distribution groups and contacts. The process is documented automatically. Step by step process Use the search field to find the desired mailbox. Right-click on the Mailbox and select "Edit addresses" from the context menu Protected Networks GmbH

16 16 User Provisioning 1. Add an address or delete an existing one. 2. Select the primary address. 3. Double-click the field where you want to enter or change the address. 4. You must enter a comment, for example the ticket number. 5. Start the process.

17 The Joiner - Phase Changing mailbox permissions Background / Value 8MATE Exchange displays the access rights to Mailboxes in the resource view. Mailbox access rights are shown as follows: "Owner", "Full access", Read Access rights" and "Administrate". Additionally you can also assign the following access rights to individual users: "Full access", "Send as" and "Receive as". Step by step process Use the search field to find the desired mailbox. Right-click on the mailbox and select "Modify access rights" from the context menu Protected Networks GmbH

18 18 User Provisioning 1. Use the search field to find the desired account. 2. Use drag & drop to move the account to an access rights column. 3. Click on "Apply". 1. You must enter a comment, for example a ticket number. 2. Start the access rights change.

19 The Joiner - Phase Managing out of office notices Background / Value 8MAN allows help desk to set out of office notices for employees without gaining access to content. Step by step process Use the search field to find the desired mailbox. Right-click on the mailbox and select "Edit Out of Office" from the context menu Protected Networks GmbH

20 20 User Provisioning 1. Determine the out of office settings. 2. You must enter a comment, for example a ticket number. 3. Start the process.

21 The Joiner - Phase Managing mailbox and size Background / Value Managing mailbox size is a common task for help desk. 8MAN allows you to make these quickly and efficiently. Step by step process Use the search field to find the desired mailbox. Right-click on the Mailbox and select "Edit mailbox and size" from the context menu Protected Networks GmbH

22 22 User Provisioning 1. Click on "Customize" to change the mailbox size. 2. Quickly add 1 GB of storage. The increments can be adjusted in the configuration module. 3. Click on the pen icon to edit the maximum size. 4. You must enter a comment, for example a ticket number. 5. Start the process.

23 The Joiner - Phase The Management of distribution groups Enter topic text here Managing distribution group memberships Background / Value 8MAN allows you to manage the members of distribution groups. This includes the addition and removal of recipients as well as the nesting within other groups (parent child relationships). The process is automatically documented. Step by Step process Use the search field to find the desired distribution group Protected Networks GmbH

24 24 User Provisioning 1. You are focusing on the desired group. 2. Right-click on the group and select "Change group memberships". 1. Find an account. 2. Use drag & drop to move the account to a column, to assign a group membership. 3. You can remove memberships with the "Remove" button. 4. You must enter a comment, for example a ticket number. 5. Click on "Immediately".

25 The Joiner - Phase Managing distribution group permissions Background / Value 8MAN allows you to change who can send s from which distribution groups. As usual, this is automatically documented. The most relevant cases are "Send as" and "Send on behalf". The former is especially sensitive since it is not clearly indicated who actually sent the . With "Send on behalf" on the other hand the "deputy" sender is clearly visible. Step by step process Use the search field to find the desired mailing list. 1. Find the desired distribution group. 2. Right-click on the group and select "Modify access rights" from the context menu Protected Networks GmbH

26 26 User Provisioning 1. Use the search function to find the account. 2. Use drag & drop to assign the desired permission. 3. Select an entry and use the context menu to remove a permission. 4. Click on "Apply". 1. Enter a comment. 2. Start the access rights change.

27 The Joiner - Phase Changing the moderation of distribution groups Background / Purpose With 8MAN you can quickly modify the moderation of distribution groups. The process will be documented automatically. If no moderators are nominated the role is filled out by the manager of the group. Step by step process Use the search field to find the desired distribution group. 1. You are focusing in the desired group. 2. Right-click on a group and select "Edit moderation" Protected Networks GmbH

28 28 User Provisioning 1. Enable or disable the moderation of the distribution group. 2. Use the search field to find accounts. 3. Use drag & drop to move accounts to the column"moderators" or "Sender without moderation" (Whitelist). 4. Determine the workflow for rejected messages. 5. You must enter a comment, for example a ticket number. 6. Start the process.

29 The Joiner - Phase Changing the manager of distribution groups Background / Value 8MAN allows you to quickly change managers for distribution groups. The process is automatically documented. In the default settings, managers are the only ones allowed to change the configuration. Step by step process Use the search field to find the desired distribution group. 1. You are focusing on the desired group. 2. Right-click on the group and select "Edit Manager" Protected Networks GmbH

30 30 User Provisioning 1. Use the search field to find the desired accounts. 2. Use drag & drop to move accounts to the column "Moderators" or "Send without moderation" (Whitelist). 3. You can also remove accounts. 4. You must enter a comment, for example a ticket number. 5. Start the process.

31 The Joiner - Phase Management (Data Owner) Managing SharePoint permissions Background / Value 8MATE for SharePoint integrates all SharePoint resources into 8MAN. This way all analytical and management tasks are centralized with access rights management processes for other resources. You can conveniently view all access rights across your network and make changes quickly and efficiently. Step by step process 1. Select "Resources". 2. Navigate to the desired resource. 3. Right-click on the resource and select "Modify access rights" from the context menu. 1. 8MAN switches to the "Permissions" view. 2. Use the search field to find the desired accounts. 3. Use drag & drop to move an account into an access column to assign access rights. 4. Use the context menu to remove a user. 5. Click on "Apply" Protected Networks GmbH

32 32 User Provisioning 1. Verify planned changes. 2. You must enter a comment. 3. Start the change process.

33 The Joiner - Phase Changing folder permissions Background / Value Access rights should be easy to assign and revoke. You can do this quickly and easily for the employees in your department. You don't need any special knowledge of Active Directory and / or file servers. Simply decide what type of access rights you would like to assign: modify or read and execute. In order to maintain data integrity we recommend assigning change rights only to carefully selected employees. Step by step process 1. Use the search field to find the desired directory. 2. Click on the search result Protected Networks GmbH

34 34 User Provisioning 1. 8MAN switches to the "Resources" view. 2. Select a sub-directory if desired by right-clicking on it. 3. Select "Modify access rights...". 1. 8MAN switches to the "Permissions" view. 2. 8MAN shows you the directory that you are working on. You can change this directory. 3. 8MAN shows you all existing access rights in the categories "Modify" and "Read & execute".

35 The Joiner - Phase Use the search field to find the desired user or group. 2. You can enter the content into the clipboard, for example an 8MAN Text. 8MAN will then find known objects and filter them from the text. 3. Use drag & drop to move the users into a column and assign corresponding access rights. 1. The user is added to the column. 2. Click on "Apply" Protected Networks GmbH

36 36 User Provisioning 1. You must enter a comment. 2. Start the access rights change.

37 The Joiner - Phase Protected Networks GmbH

38 3. The Mover - Phase

39 The Mover - Phase Management (Data Owner) Data Owner: Recertification of existing access rights Background / Value Safety regulations demand for the implementation of the principle of least privilege. This is why data owners must check periodically the access rights situation of their resources. With the re-certification process you obtain the possibility to check and change the access rights situation to your resources. You receive an with the instructions to the re-certification process. Then you decide for each user and resource if the access right should stay or be removed. Your desired changes will be transferred automatically to the administrator. Complementary Services Change file server access rights The process in single steps Click "Recertification" Protected Networks GmbH

40 40 User Provisioning Click on "Start new Recertification". Click on one or more directories. The directories selected are shown on the right. Click on "Start new recertification". You can either accept or remove the permissions. Activate all Users which should keep their permissions first. Click on "Accept". Subdirectories are only displayed, if they contain deviating permissions. Please fill in a comment. Your notes will be saved in the system for documentation.

41 The Mover - Phase 41 Do the same for the permissions you want to remove. Your decision is marked in the colum "action". Click on "Final Execute". The Administrator gets a list of your decisions for implementation. Temporary permissions of user accounts, which are also authorized with a permission that never expires, will become ineffective and not be shown in the marked column above. If you click on "Final execute" your administrator receives almost every time an with your desired changes. This is why we recommend to do the recertification in one go Protected Networks GmbH

42 42 User Provisioning 3.2 Employee Requesting file server access rights from Data Owners Background / Value Employees can request access rights to file server directories from Data Owners by using the 8MATE GrantMA self-service portal. You can configure a variety of different processes and involve the relevant decision makers, depending on your security requirements. Additional Services Creating approval workflows Step by step process 1. Enter your username and password. 2. Click "Login".

43 The Mover - Phase 43 Click "New Request". 8MAN will show the person requesting access to new resources the exact resources that are available to them. Select the desired resource and click on "order" Protected Networks GmbH

44 44 User Provisioning 1. Select an access category. 2. Click "add to shopping cart". Add additional resources if desired. Click on "Order Basket".

45 The Mover - Phase Delete the order entries. 2. Add a recipient to your order. You are able to request access for other users. 3. Remove the recipient. You can also remove yourself and only request access for other users. 4. You must enter a comment. 5. Start the request. Once confirmed, 8MAN shows you an overview of your requests. 1. Open or close the detail view of an order. 2. You can see more details. 3. Resend a notification to the approver. 4. Cancel your order Protected Networks GmbH

46 46 User Provisioning 3.3 Help Desk Moving objects in Active Directory Background / Value 8MAN is able to move objects, meaning user accounts, group accounts and computers from one OU into another. This may be required if one of your users moves location or new group policies are applicable. 8MAN fully documents all movement among OUs. Step by step process 1. Use the search field to find the desired object. 2. Right-click on the object. You can do this in the "Accounts" view. Then select "move object". 1. If required change the login which will be used to move the object. 2. Select a destination path. 3. You must enter a comment. 4. Start the process.

47 The Mover - Phase Modifying group and user attributes Background / Value With 8MAN you can easily manage attributes for users accounts in a flat list. All actions are automatically documented. Step by step process 1. Use the search field to find the desired user or group. 2. Right-click on the user or group. You can do this in the accounts view. 1. Change the desired attributes. 2. You must enter a comment. 3. Start the execution Protected Networks GmbH

48 48 User Provisioning Resetting passwords Background / Value Resetting passwords is one of the most common tasks performed by help desks. 8MAN allows an easy and secure way of resetting passwords. All sensitive actions are documented in the log book. If an employee uses native tools to reset a password and illegally tries to access that user account, the incident is captured with AD Logga. Especially sensitive user accounts can be monitored with 8MATE Alerts. Additional services 8MATE AD Logga: Identifying locked accounts 8MATE Alerts: Monitoring a user account Step by step process 1. Use the search field to find the desired user. 2. Right-click on the user and select "reset user password". You can do this in the accounts view.

49 The Mover - Phase Determine your password options. 2. You must enter a comment, for example "ticket number" or "authorized by". 3. Start the reset process Protected Networks GmbH

50 50 User Provisioning Unlocking user accounts Background / Value Unlocking user accounts is one of the most frequently performed action of most help desks. 8MAN makes the password reset revision proof. All actions are documented in the logbook. Additional Services If employees use native tools to unlock a sensitive account, AD Logga will capture all activity. Especially sensitive accounts can be monitored with 8MATE Alerts. AD Logga: Identifying locked user accounts 8MATE Alerts: Monitoring a user account Step by step process 1. Use the search field to find the desired user or group. 2. Right-click on the user or group and select "Unlock user" from the context menu. You can do this in the accounts view.

51 The Mover - Phase You must enter a comment, for example "ticket number" or "authorized by". 2. Start the unlocking process Protected Networks GmbH

52 52 User Provisioning

53 4. The Leaver - Phase 2017 Protected Networks GmbH

54 54 User Provisioning 4.1 Helpdesk Help desks love working with 8MAN. They can complete their tasks more quickly and all documentation is automatically taken care of by 8MAN Deactivating a user account Background / Value If you deactivate an account with 8MAN, this is equivalent to a normal deactivation in Active Directory. The user account remains in the OU. Additional services Deleting a user with soft delete Step by step process 1. Use the search field to find the desired user. 2. Right-click on the user and select "deactivate account" from the context menu. You can do this in the accounts view.

55 The Leaver - Phase You must enter a comment, for example "ticket number" or "authorized by". 2. Start the execution Protected Networks GmbH

56 56 User Provisioning Deleting a user account by using the "soft delete" feature Background / Value When deleting a user with "soft delete" all of their access rights remain intact. The account is moved to a "Recycle-OU" and deactivated. This account can no longer be used since the "Recycle-OU" is part of a strictly limited group policy. Additional Services Setting the "recycle-ou" Step by step process 1. Use the search field to find the desired user. 2. Right-click on the user and select "soft delete account" from the context menu. You can do this in the accounts view.

57 The Leaver - Phase You must enter a comment, for example "ticket number" or "authorized by". 2. Start the process Protected Networks GmbH

58 58 User Provisioning Removing a user and their permissions Background / Value With 8MAN you can delete the user from AD and remove all of their access rights on the file server in one easy action. Additional Services Removing direct permissions in bulk (8MATE Analyze & Act required) Step by step process 1. Use the search field to find the desired user. 2. Right-click on the user and select "Delete account" from the context menu. You can do this in the accounts view. 1. If required change the credentials to remove the access rights. 1. Activate the option "Remove access rights" to avoid unresolved SIDs on file servers. 2. You must enter a comment, for example "ticket number" or "authorized by". 3. Start the process.

59 The Leaver - Phase Protected Networks GmbH

60 60 User Provisioning