(bright music) - Did you know that you can automate
most of the manual steps to onboard and offboard
users as they enter or leave your organization
using Microsoft Entra? How you manage user identities in IT, along with just enough permissions for users to access necessary information, as well as any additional steps needed to provide users with what they need, like hardware, to be
productive is critical to how effectively people
can get up and running. Conversely, as people
leave the organization, deprovisioning is just as critical to maintain security and compliance. That's where Lifecycle Workflows and Microsoft Entra ID Governance can help with its prebuilt
templates for common tasks. Now, if you're not familiar
with Microsoft Entra, it's a complete identity
management platform with everything you knew
about Azure Active Directory, along with a number of new capabilities. Identity lifecycle management automation removes many of the manual steps for your everyday
identity management tasks while helping you to improve
your overall security posture. And it means users don't
need to spend days or weeks hunting down information, requesting access to important documents or getting a work-provided
computer ordered and set up. Instead, with Lifecycle Workflows, not only do you save time, but users experience more consistency, which means better job
satisfaction and reduced risk. And it also works with your HR systems, like Workday and
SuccessFactors and others, as part of the onboarding
and offboarding workflow. So let's look at how Lifecycle Workflows
automate common tasks starting with user onboarding. So here's an example with new users already added
to an HR system, Workday. Now we can see that there are three users who have already been created, and they've also been
added to Microsoft Entra ID formerly known as Azure AD. Now from the Entra portal, you can see Lisa Taylor's profile and all the attributes
were automatically mapped from Workday, including her hire date. So she is in the directory service but doesn't yet have access to what she needs to get her job done. So let's take care of that. In Lifecycle Workflows, I can easily create a custom workflow to run before an employee's start date using one of the prebuilt
workflow templates. Now these automatically detect users that match the conditions
set in the workflow so you can save time. Now I'll choose the pre-hire template, and I'll give it a name, and I can already see that it's set to run seven days before the
employee's hire date. The correct department is already set. So I'll just set the state
attribute for Washington state as an additional scope
to tailor things further. Next, I'll head over to review tasks, and this one is built in to generate a temporary access pass or TAP and send an email with the information Lisa
needs to get started. Now this is important because Lisa might only
have an offer letter from her hiring manager but won't know how to
access work resources. So now I'm going to add a few custom tasks to add her to the right groups
for access to information. And beyond information access, we can also use the
automation to do things like trigger ordering computer
hardware and peripherals. And for that, I'll choose
a custom task extension to integrate with an external system that we use to purchase hardware. For the first group's task, I'll click in, search for marketing. There it is, add the group
and then hit select and save. And with the security
principle of least privilege, she only has access that's needed for her to get her job done and nothing more. Next, I'll configure the second task, which will order the new hardware
using our external system. In this case, we want to create a ServiceNow
ticket to trigger this. So I'll just select my custom extension for ServiceNow hardware procurement. There it is, and hit save. And now I can review all of my parameters. Based on our schedule, the workflow will
automatically run every hour, and matching our conditions, only apply to new marketing
hires who are set to start in the next seven days
in Washington state. Now I just need to hit create to confirm, and the workflow is enabled. So that's an example of the
pre-hire onboarding steps Microsoft Entra can automate to save time while giving users just enough access. Now let's switch gears to
another common scenario, employee offboarding and making sure that access to information
and resources can be revoked automatically, quickly and
consistently to reduce risk. Now using the built in leaver templates, I've already set up real-time separation and post-offboarding workflows based on my company's policies. Now I'll show you a case where an employee is leaving
to join a competitor. For that, I'm going to use the real-time separation
on-demand workflow, which can run instantly in cases where access
revocation timing is critical. Now this workflow will disable an account, removing it also from all Microsoft Teams. I'll choose our user, Vance, and select, which will then kick off the
workflow to run on demand, and then access has been revoked. Now beyond this case, for
all other leaver scenarios, you can establish automated policies to enforce complete access revocation. For example, you might have a
policy in place for managers to complete an offboarding
checklist within 30 days for anyone leaving the organization. Lifecycle Workflows can also help when managers don't complete
offboarding checklists in time and also serve as a failsafe to take the additional steps
for cleaning up access, also removing group memberships,
license assignments, and send an email to
the manager and HR team, and finally, per policy,
delete those accounts. Additionally, as an employee goes through the offboarding process, your company policy or sometimes
a regulatory requirement may stipulate that each
task has been completed and that you have a full
audit log of activities. So with Lifecycle Workflows, you can see a complete
history for each employee, and within the workflow history, you can monitor the progress of workflows, like the one that we just kicked off for real-time separation with Vance. Because these might be multitask workflows running over a longer period of time, you can also drill in to see
the status of individual tasks. So here, I'll check the workflow history to view the details of
previous workflow runs, including the status for our tasks. In fact, the workflow
history is a great way to see a summary of either
onboarding or offboarding runs as employees enter or
leave your organization, then troubleshooting the errors that you might find in the process. Here, we're looking at the
history for onboarding new hires, and you'll see that there's
an issue with two of our runs. So I'll drill into the
first one to find out more. In the user's tab, I can see that one of
the tasks has failed, which has left three remaining
subsequent tasks unprocessed. Now moving into the task
tab from the workflow run, it looks like the welcome email has failed due to a missing or invalid email address. Lifecycle Workflows also
have built-in change tracking with versioning to see changes made as people iterate on their workflows, for example, by adding or removing tasks. So here's a list of eight
workflows in our organization, and you can see which
ones run on a schedule and which ones are enabled. In the right column, you'll also see the number of versions that have been iterated on
until now for each workflow. And it looks like this one for onboarding new hires has
been revised quite a bit. Now when I drill into it, you'll see the complete version
history for the workflow. And if I look into the
most recent version, I can see who created and
modified the latest workflow when it was created and all the workflow details to make sure that there aren't any issues
that need to be corrected. Often, onboarding workflows
will increase their number of tasks over time as you automate more and more
of those manual processes. Version 10, in this case, has fewer tasks than before
with just three tasks. One to enable the account,
then add it to Teams and send a welcome email. If I'm familiar with this workflow, I can compare that with
the previous version. In fact, I'm going to
close out version 10, and then I'm going to look at
version 7 to see its details. And you'll see there are two more tasks to run a custom extension. Remember, that's our
hardware procurement process from before, and generate
a temporary access pass so that new hires have a way to sign into their work resources. Now I can use this information
then to go back to my team and figure out why the change was made and potentially add
those missing tasks back into our new hire workflow. So now you've seen how identity lifecycle
management automation, Microsoft Entra, can automate
a lot of the manual tasks and steps for onboarding
and offboarding users and how it supports troubleshooting and change management
with automated tasks. To learn more, check out aka.ms/ILMDocs, and you can try it out today
at entra.microsoft.com. Keep checking back to Microsoft Mechanics for the latest in tech updates. Hit subscribe, and thank you for watching. (bright music)
