Azure Role can be assigned to the AAD security principal directly.

To assign Azure Role directly to the AAD User

1. In One Identity Manager, navigate to Azure Active Directory.
2. Select the User account to which the Azure role must be assigned.
3. Select Azure Role Assignment from Tasks.
4. To add the Role, select the role scope mapping from the Add assignments list.
5. Save the changes.

To assign Azure Role directly to the AAD Group

1. In One Identity Manager, navigate to Azure Active Directory.
2. Select the Group to which the Azure role must be assigned.
3. Select Azure Role Assignment from Tasks.
4. To add the Role, click Add in the form.
5. Select the Role Scope mapping from the dropdown list.
6. To add new Role Scope mapping click on ‘+’ button.
7. Click on Add new dynamic key button 
8. Select Scope from Table and item from scope as per requirement.
9. Click on Ok.
10. Save the changes.

To assign Azure Role directly to the AAD Service Principal

1. In One Identity Manager, navigate to Azure Active Directory.
2. Select the Service Principal to which the Azure role must be assigned.
3. Select Azure Role Assignment from Tasks.
4. To add the Role, click Add in the form.
5. Select the Role Scope mapping from the dropdown list.
6. To add new Role Scope mapping click on ‘+’ button.
7. Click on Add new dynamic key button 
8. Select Scope from Table and item from scope as per requirement.
9. Click on Ok.
10. Save the changes.

To add new Role Scope Mapping

A new Role Scope Mapping for Role Assignment can also be created from Tenant node from Azure Cloud Access Governance in One Identity Manager.

1. In One Identity Manager, navigate to Azure Cloud Access Governance.
2. To view/add Role Scope Mapping for specific tenant, Click on Tenants
3. Extend the node of Tenant where you want to add the Role Scope Mapping
4. Select Role Scope Mapping
5. To add new Role Scope mapping click on ‘+’ button.
6. Click on Add new dynamic key button 
7. Select Scope from Table and item from scope as per requirement.
8. Click on Ok.
9. Save the changes.
10. To view/add for All Tenants, after clicking on Node ‘Tenants’ follow the same procedure from Step 4

Assigning Azure Roles to the AAD Security Principal through ITShop

Azure Role can be assigned to the AAD Security Principal through ITShop. Employee with Azure Active Directory account can raise request for Role Assignment for his own user account, any AAD Group and any AAD Service Principal belonging to the tenant.

Once the request is raised, the owner of the scope object for which role assignment request is created (scope here refers to management group, subscription, resource group or resource) approves the request.

The way approval works is that if the owner of the scope object is not found, then request for approval is sent to the owner of the parent scope object and so on in the hierarchy and if none of the scope object owners are configured, the request for approval goes to the Target System Manager.

The hierarchy for approval workflow is:

Resource Scope Owner -> Resource Group Scope Owner -> Subscription Scope Owner -> Management Group Scope Owner -> Parent Management Group Scope Owner -> Tenant Root Scope Owner -> Target System Manager.

To assign Azure Role to the AAD Security Principal through ITShop

1. Login in to ITShop portal
2. Add new request
3. Request Product from ITShop to Add to cart:
   1. Azure Infrastructure Azure AD Group Role Assignment, Azure Infrastructure Azure AD Service Principal Role Assignment, Azure Infrastructure Azure AD User Role Assignment.
4. Enter required values:
   1. AAD Organization Name, AAD Group/Service Principal/User Name, Azure Scope, Azure Roles
5. Click Submit.
6. Once approved by approver, the role assignment will be done.

Remove Azure Roles directly from AAD Security Principal

Azure Role Assignments can be removed for an AAD User, AAD Group or AAD Service Principal. Using One Identity Managers role assignments done at Root Scope can also be removed.

To remove Azure Role from the AAD User

1. In One Identity Manager, navigate to Azure Active Directory.
2. Select the User account from which the Azure role must be assigned.
3. Select Azure Role Assignment from Tasks.
4. To remove the Role Assignment, select the role scope mapping from the Remove Assignments list.
5. Save the changes.

To remove Azure Role from the AAD Group

1. In One Identity Manager, navigate to Azure Active Directory.
2. Select the Group from which the Azure role must be removed.
3. Select Azure Role Assignment from Tasks.
4. To remove the Role Assignment, select Azure Role Assignment to be removed from the list.
5. Click on Remove.
6. Save the changes.

To remove Azure Role from AAD Service Principal

1. In One Identity Manager, navigate to Azure Active Directory.
2. Select the Service Principal from which the Azure role must be removed.
3. Select Azure Role Assignment from Tasks.
4. To remove the Role Assignment, select Azure Role Assignment to be removed from the list.
5. Click on Remove.
6. Save the changes.

Remove Azure Roles from AAD Security Principal through IT Shop

To remove Azure Role for an AAD Security Principal through ITShop

1. Login to the ITShop portal as the user who raised the ITShop request
2. Go to request history
3. Click on Details
4. Click on Unsubscribe Product
5. Add comment and Save