Chapter 29 — Identity and access management: operations

Chapter 29 — Identity and access management: operations

Lesson map

Lesson 29 published. Map, example, EX085.

flowchart TD
  N0["Learning outcomes"]
  N1["29.1 Monthly routines"]
  N2["29.2 Access requests"]
  N3["29.3 Reporting"]
  N4["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4
  N4 --> EX["Worked example"]
  EX --> Q["Exercise EX085"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["29.1 Monthly routines"]
  N2["29.2 Access requests"]
  N3["29.3 Reporting"]
  N4["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> Q["EX085"]

[Learning outcomes]
    |
    v
[29.1 Monthly routines]
    |
    v
[29.2 Access requests]
    |
    v
[29.3 Reporting]
    |
    v
[Synthesis]
    |
    v
[Worked example] --> [Exercise EX085]

Learning outcomes

You will (1) run monthly identity routines; (2) handle access requests; (3) report to managers.

29.1 Monthly routines

Elena writes a monthly routine for Greenhill's IT team: run the identity report, check leavers against all systems, review administrator accounts, check multi-factor coverage by team and look at accounts unused for ninety days. Each task has a checklist and expected time, so the routine takes about two hours. Writing routines down means they continue when someone is on holiday or leaves, which is exactly when undocumented habits tend to stop. The routine is reviewed every six months and updated when systems change, so it always matches how Greenhill actually works.

29.2 Access requests

Staff request access through a simple form naming the system, the reason and the group needed. The group owner approves or declines. IT then adds the person to the group, never granting individual permissions directly. Requests and decisions are kept so later reviews can see why access was given. This replaces informal emails and corridor requests, which left no record and made it impossible to know whether access had ever been approved by anyone responsible. Declined requests are kept too, with the owner's reason recorded.

29.3 Reporting

Each month, a one-page summary goes to the senior management team: multi-factor coverage, leavers disabled within one day, administrator count, shared accounts remaining and open actions. Each figure shows this month, last month and target. Elena keeps it short so managers actually read it. When figures worsen, the summary explains why, such as a new team not yet enrolled, so managers understand and support the work rather than losing confidence. Open actions list an owner and a due date. Managers can ask for more detail, which Elena provides in a short appendix rather than crowding the main page.

Worked example

The monthly routine takes about two hours; the first summary shows coverage at 90 percent and all leavers that month disabled within a day.

Synthetic case. Routines, figures and reports are synthetic.

Errors and limits

Undocumented routines stop when the person who knows them is away.

Exercises

• EX085 — Routine tasks. Name three monthly routine tasks. Rubric: 3 = identity report, leaver check, admin review, MFA coverage, unused accounts (three);; 2 = two;; 1 = one;; 0 = none.
• EX086 — Direct permissions rule. How does IT grant access after approval? Rubric: 3 = adds to a group, never individual permissions;; 2 = groups;; 1 = direct;; 0 = none.
• EX087 — Summary contents. What does each summary figure show? Rubric: 3 = this month, last month and target;; 2 = two;; 1 = one;; 0 = none.

Synthesis

Written routines, recorded requests and short monthly summaries keep identity management running.

Continue studying — chapter 29 of 40

← Chapter 28 (draft) · Course chapter index · Chapter 30 (draft) →