You can change the permissions in a permission level, and the name or description.
To modify an existing SharePoint permission level
The security for the resource displays in the lower pane.
|
Note: This functionality is not available for NFS or Cloud managed hosts. |
Before managing user or group access to data (for details, see Managing account access), you may want to compare the access for two accounts, or model what would happen if you modified an account’s group membership.
This enables you to model access including:
The results of an account comparison shows where there are deviations between the two account's access (different access); and where the accounts hold identical access or have the same access but it was obtained differently (similar access).
You can save the results in customized layouts that will help you to see where and if changes are required to your current account access. For ease of use, Data Governance Edition includes predefined layouts that allow you to see the types of access (differences only, similar only), rights held by the source account only, and rights held by the target account only.
The results of an account simulation shows the rights that would be granted or revoked based on the change made to an account's group membership.
Comparing accounts can help you understand the group deployment within your organization. You can easily investigate two groups with similar or identical permissions to determine groups that could be consolidated into one.
Comparing accounts can also be helpful as a troubleshooting tool. If two accounts should have the same access to a resource but one account is being denied access, you can compare their access to see where the differences are found and make the necessary adjustments.
|
Note: If you see a message in the list of issues that the forest or domain could not be contacted, this could be because the trusted domain has not been synchronized with One Identity Manager. |
To compare accounts
Navigate to and select an account (through the Security Index node, Accounts view, Security editor, etc.)
Select one of the following options to define the type of access to be compared:
Compare explicit: Select this option to compare access that has been granted explicitly.
|
Note: For machine local trustees, well-known group accounts and built-in group accounts, the account comparison will compare only explicit rights, regardless of the option selected. |
The Source field defines the source account to be compared. By default, the selected account appears. Click the browse button ( ) to locate and select a different source account.
The Target field defines the target account to be compared. Click the browse button ( ) to select the target account.
The Resource Types field defines the types of resources and the managed hosts to be included in the comparison. By default, all resource types and all managed hosts are included.
Click the Change button to limit your comparison to selected resource types or managed hosts. Clicking the Change button displays additional fields allowing you to make your selections:
Type: Click the arrow control to select one or more types from a list of available resource types. To exclude a resource type, click the selected check box to clear it.
|
Note: Running an account comparison against all hosts and resource types could take a significant amount of time to process. It is recommended that you select the hosts and resource types you are interested in to speed up the comparison process. |
Click Compare to run the account comparison for the selected accounts.
For each resource path to which either account has access, the rights of both accounts are returned. If a column has no entry, that account has no access to the resource. See Account comparison results for more details on how to interpret the results.
By default, the Default layout is used to display the results, which shows all resource access available. Other predefined layouts available include:
Show Similar Access
|
NOTE: You can use the Layout controls to select a predefined layout for displaying data. If you do not see the Layout field or buttons, use the Toggle layout options task to display these controls. |
Optionally, click the Export to CSV button to export the results to a file. The Save As dialog appears allowing you to select the location where the report is to be saved and to specify a file name.
|
Note: The exported CSV file contains more information about the account comparison. For example, it contains the managed host ID which can be used to run scripts/commands against a particular managed host. |
The Account comparison feature in the Manager allows you to compare the access for two accounts. The results are grouped by:
The account comparison results contain the following details.
Column | Description |
---|---|
Resource Name | The name of the resource to which one or both of the selected accounts has access. |
<Source Account> |
Indicates whether the Source account has access to the resource.
|
<Target Account> |
Indicates whether the Target account has access to the resource.
|
Right | The type of access granted to the resource. |
Via Group |
Displays the name of the account through which the displayed access (Right column) was granted.
|
Governed Resource |
Indicates whether the resource is governed:
|
Column | Description |
---|---|
Resource Name | The name of the resource to which both of the selected accounts have similar access. |
<Source Account> |
A green check mark indicates that the Source account has access to the resource.
|
<Target Account> |
A green check mark indicates that the Target account has access to the resource.
|
Right | The type of access granted to the resources. |
Via Group |
When rights are granted through the same group membership, the name of the group through which the access was granted. |
Governed Resource |
Indicates whether the resource is governed:
|
© 2023 One Identity LLC. ALL RIGHTS RESERVED. Feedback Terms of Use Privacy