Skip to end of metadata
Go to start of metadata

You are viewing an old version of this page. View the current version.

Compare with Current View Page History

Version 1 Next »

Overview

Profiles and profile grants improve efficiency across the organization, they are the evolution of Business Roles. Activated profile grants can reduce the number of permissions to be reviewed in User Access Reviews. Profile grants also allow you to quickly onboard users, ensuring that they have appropriate permissions from the start. Profile grants have one of two levels, birthright or suggested, giving admins more control over which permissions are provisioned during onboarding.

Terminology

Profile: A collection of user demographic properties based on roles in your organization, for example Department = Engineering & Title = Engineer. A user may be associated with zero or more profiles and there may also be a profile for All Users.

Profile grant: Mapping between a profile and a permission.

Birthright level: Birthright level indicates all users in the profile should have the permission.

Suggested level: Suggested level indicates all users in the profile may have the permission.

Profile grant states:

  • New - Grants suggested by Zilla but not yet activated.

  • Activated - Grants that are used for onboarding and access reviews.

  • Deactivated - Grants that are no longer used.

Profile actions:

  • Activate Grant - Makes profile grants eligible for onboarding and access reviews.

  • Deactivate Grant - Declined grants will not be used for onboarding nor access reviews.

  • Reassign Approver - By default, the Technical Owner of the permission’s application is the approver of the profile grant. Reassignment can be to TBD.

  • Edit Level - Zilla suggests either birthright or recommended but this can be manually overridden.

How to Generate Profiles

The Zilla administrator initiates profile generation. The tenant’s data is analyzed to create a collection of profiles each with a collection of profile grants. Profile grants originate in the New state and before they can be used in an access review or for provisioning, they must be activated. By default, an application or permission owner is responsible for reviewing and activating profile grants but Zilla admins can also activate.

How to Customize Profile Generation

After the initial profile generation, the administrator can re-generate profiles and specify the scope in terms of the population and which demographic values to use. The user demographic fields that are available to choose from are based on this particular tenant's collected user metadata. In order to be included, the field must be collected and populated. They may change the system defaults regarding minimum quality and population of profiles.

GenerateProfilesCustomize.png

TBD: How-to video? Or a step-by-step?

New Profiles

NewProfiles.png

(1) Profiles grants can be viewed in several different ways: By Profile, By Application, List.

(2) Active User Permissions displays the count of permissions across all accessible applications that are mapped to active users.

(3) Total Grants displayed by state. See state definitions in Terminology.

(4) Total Profiles shows the average number of profile grants per profile and the number of applications with profiles.

(5) Table columns:

  • Profile - User attributes shared by a population of users.

  • Users - Number of users matching the profile.

  • New/Notified/Active Grants - Number of profile grants within the profile by state.

  • Last Updated - Displays when this profile grant’s status was last updated.

  • Actions - Click View to see a list of grants for the profile to take an action. See actions definitions in Terminology.

(6) Search and Filter provides the ability to search the profiles and filter by Profile and Last Updated.

  • No labels