I have Azure AD Premium and O365 Enterprise License assigned for my users. Is it possible for me to allow the users to update their AD profile information, such as Job title, Department ?
Is it possible for me to allow the users to update their AD profile
information, such as Job title, Department ?
Yes, you could make this, you need to Assign roles to users. Because it requires a Global administrator or user administrator to add or update a user's profile information.
For the details, you could read this doc.
Related
can anyone explain the complete process to create a snowflake organization account and the way to attach/detach account from it? I looked into the snowflake console as well as in documentation but have not gotten clarity
You should submit a ticket to Snowflake Support to enable organization on one of your accounts. This will create the ORGADMIN role in the account. Then you can grant this role to one of your users. The user which has the ORGADMIN role can access the Organization page. From the organization page, you can see your existing accounts, and create new accounts. When you create a new account, it will be in your organization automatically.
If you have an account which you can't see on the organization page, that means the account was created in another organization. In this case, you need to submit a ticket to Snowflake Support and ask them to move your account to your organization.
Normally, it's expected that each customer should have one organization, but if you have multiple organizations, you can also ask Snowflake Support to move your account from one organization to antother (that's how you would detach). If you want to drop an account, you should also contact Snowflake Support, it can't be done through the organization page.
We implemented SSO on Snowflake and with SCIM, we're able to provision users in Snowflake
Now, I want it to work like SQL Server authentication where I can add users to the same AD group and create a single login on SQL Server for this AD group. To revoke login permissions I just remove the user from the AD group. To give a new person access I just add them to it.
I would like also to map a role to a group, so, for instance, if I could link an Azure AD Group to a Snowflake Role [Read-Only User for Database X], as soon as I'm adding a user Y in Azure AD Group, this user Y will have automatically read-only access to Database X
Is it possible ?
Regards,
This same concept is possible in Snowflake as well with SAML SSO (for authorization) and SCIM (to sync users and their corresponding roles to SF). The details for this are here:
https://docs.snowflake.com/en/user-guide/admin-security-fed-auth-configure-idp.html
https://community.snowflake.com/s/article/HOW-TO-Setup-SSO-with-Azure-AD-and-the-Snowflake-New-URL-Format-or-Privatelink
https://docs.snowflake.com/en/user-guide/scim-azure.html
Both these together will ensure that the user created on Azure AD will be possible to login with the AAD credentials and the SCIM will ensure that the relevant role management is on the AAD side which is reflected exactly as-is on the SF side.
I'm not able to access any tabs in AAD. What could be the issue?
Please check if below points can be worked around in your case.
Buttions or options being greyed out maybe because , you may not have had global admin rights/user administrator rights on the azure AD tenant. There are a few roles which can create users within the directory. You may not have any roles within the directory which permit the operations.
Reference: github issue.
Even in Azure AD free edition ,one should be able to create the users if you have proper roles .
On completion of the first 30 days of Microsoft Azure’s free trial,
your ‘Free Trial’ Azure Subscription will be disabled. To fix this,
the subscription needs to be changed to the ‘Pay-As-You-Go’ plan
instead of the ‘Free Trial’ plan which it is currently on.
For example :For applications under Enterprise application, one of the following roles: Global Administrator, Cloud Application
Administrator, Application Administrator, or owner of the service
principal.
You can check Azure AD built-in roles, and by checking the
description of role , assign the required one to manage identity .
You can Assign Azure AD roles to users to manage the identities
if you have global or role administrator rights. Approach the
admin to assign the roles .Also see custom roles in Azure AD
if needed.
Please check if this issue in - Microsoft Q&A can relate .
If issue still remains you can raise a support request in troubleshoot+support blade.
We have an Azure AD Tenant and External users from different organizations are added as Guest in this tenant.
When sharing content with other users, Guest users from different organization can see each other. Is there a way to prevent this enumeration? I see that a new Feature is comming wherin Guest user cannot be #mentioned
Try to set guest user access is restricted to properties and memberships of their own directory objects. This restriction level is the highest. When guests are restricted, they can only view their own user profiles but not other users. See: restrict guest user access.
Log in to the Azure portal as an administrator, go to User settings>Manage external collaboration settings>Select Guest user access is restricted to properties and memberships of their own directory objects (most restrictive)
I'm trying to set up security for my application for users. I am not sure about my logic. Is the following possible:
I want to create 1 login for 'all users' in Active Directory. Then I want an admin (in the program self) to choose which user is in which server role (e.g. marketing, sales, ...). Then I want to give those roles permissions to the tables in the database.
Some questions about this:
Is this safe? The admin of the program has to be db owner?
Is it possible to list the users by name, instead of the login 'All users', the admin has to be able to place a user in a role after it is created in Ad.
I use the function SUSER_NAME(), will this return the current user or the groupname 'All Users'
If this isn't the right way to make security, please send me in the right direction.
Thanx!
Part of the best solution already lies in your desire to use the Active Directory to authenticate your users. Let it authorise your users as well. Marketing isn't just a database role that specifies access to your tables. It's a department of your company with file shares, mailing lists as well as a role to play in your application. Get your domain admin to make an AD group called Marketing and let them add and remove people as appropriate. Likewise for the Sales department and other departments who touch your database.
When that is done, add the MYDOMAIN\Marketing group as a login on your server and as a user in your database. It will behave more or less like the roles you've described so you can still go ahead and create the roles, add that domain group to the role and grant to the role or grant to that user directly since it identifies a group of people. This also gives you the chance to reconsider your role definitions. Are they really about Marketing people and Sales people or are they CustomerEditor, CustomerViewer, ProfitAndLossViewer roles?
User and group management is a standard function of AD administration; let them do what they do best. It probably doesn't need to feature too strongly in your solution unless you get very poor service from the domain admins, in which case, why use your AD to manage your users?
This very small change will probably free up a lot of your dev time and release you from reinventing a user management facility that already exists and is easy to use.
Good luck!
here's what i would do:
create two roles on the database, one users, one admin. then create two security groups in ad, SQL.App.Admin, SQL.App.Users (replace app with whatever your app name is). I would then assign those groups to the roles in the database. after that you can drop users and/or security groups into those two groups.