Provisioning

One of the recurring issues reported through user feedback is the slow retrieval of permissions from certain systems, which exceeds our 30-second timeout limit. As a result, we are unable to include these permissions in business rules, since loading them takes too long. A notable example is Exchange Online, which is particularly slow when fetching permissions such as distribution lists. This delay not only affects functionality but also contributes to user frustration. Even when a system retrieves permissions within the 30-second window, users still experience noticeable delays waiting even 5 seconds for permissions to load is perceived as too long. This impacts the overall user experience, especially during the setup of business rules, which is now seen as time consuming due to these loading times. To address this, we could cache the permissions from the retrieval script in a target snapshot. This means we extend the timeout of the retrieval script to 15 min. The snapshot is created a maximum off one a day automatic during enforcement and can be manually started at the business rules.

As an user, I want to set a minimum group size as a percent when running rule mining, so that any persongroup whose share of active persons is strucktly less than that percent is excluded from the results. This for all the calculations (normal, AND & OR). Example: Total persons = 10.000 Percentage = 2% (works with a single decimal) Treshold (to be included) = ceil(0.02 * 10.000) = 200 Any group with lower than 200 is excluded

Currently, to achieve more accurate results during rule mining, it's necessary to select the external ID for attributes such as department, title, and cost center. This is because names may not be unique, which can lead to inconsistent or incorrect results when rule mining is based on them. However, for display purposes, showing the name is more user-friendly and easier to interpret. To balance accuracy and usability, we perform the calculations using the external ID, while presenting the name in the report. This approach ensures reliable rule mining results while maintaining clarity for end users reviewing the output. Used contract values: Division ExternalID -> Name CostBearer ExternalID -> Name Costcenter ExternalID -> Name Employer ExternalID -> Name Location ExternalID -> Name (different names then person.Location) Type Code -> Description Team ExternalID -> Name Title ExternalID -> Name Department ExternalID -> DisplayName Organization ExternalID -> Name Used person values: Location ExternalID -> Name (different names then contract.Location)

Currently, converting a PowerShell V1 target system to a PowerShell V2 target system requires significant effort. In addition to script adjustments, we must remove and add all assigned enforcement entitlements and permissions related to business rules. This process is time-consuming and makes it difficult to verify whether script adjustments lead to changes since everything must be removed or unmanaged before granting new permissions. Therefore, we propose a method to migrate a current PSv1 target system to a new PSv2 target system. Upgrade the current PSv1 type to PSv2, which provides access to new functionality and supports the PSv2 script format. Users must confirm the upgrade and be notified that scripts require manual adjustments and that reverting is not possible.

We plan to deprecate the Azure AD Target System. This decision is based on the availability of the PowerShell v2 Target System, which offers the same functionality, runs fully in the cloud, and can be more easily extended to support various scenarios. Maintaining the built-in Azure systems requires significant effort, and we believe the PowerShell v2 approach provides a more flexible and sustainable solution for the future. Deprecation details: After this release, it will no longer be possible to create new Azure AD Target Systems. Existing Azure AD Target Systems will remain available and continue to function as usual. They will still receive maintenance and support for now. Important: Once an existing Azure AD Target System is deleted, it cannot be recreated after the deprecation takes effect. Please proceed with caution before removing any current configurations.