Does Azure or Azure AD provide a single pane of view (dashboard, report, etc.) from the portal or by other mean, allowing administrators with correct roles to pull resource assignment data across the full Azure landscape? For example, as an IAM professional and administrator, if I need to know what all does an internal user, e.g., sballmer@corporate.com or an external user (invited guest), e.g., someone@gmail.com, have access to in my tenant/space, across Azure AD and Azure features/offerings (applications, APIs, Azur Functions, SharePoint site, VMs, databases, AKVs, and such), for defining and implementing access governance processes with better IP protection and zero-trust implementation, is there something prebuilt I can use and possibly augment?
Based on the documentation and previous discussions with Microsoft (premier partner engagement), it sounds like the best that is available today is Access Reviews. The way Access Review features has been implemented and stands today, it only allows me to establish review process/automation for applications and user/groups. It suggests me to limit my concerns about applications (that I still need to handpick), individuals/groups assignment only so that I can do periodic reviews, and any subsequent changes to the application’s access permissions, etc. are totally opaque to me. It's neither complete nor a holistic solution and misses a lot of pieces that I have highlighted in the previous para.
Sounds like a custom automation can be built using the existing technologies, e.g., Graph API, KQL (Kusto Query Language) on internal Audit tables, etc. but I don't fully understand why does this have to be an organization specific need and why does everyone need to reinvent the wheel for this feature. IMO, the best would be to have some sort of mature and consistent toolset from Microsoft that provide the overarching tenancy access view for an identity (internal or external - federated or non-federated) or a group (on-prem synced or just the AAD group) that the IAM team can use the output/data from, to build the governance processes and strengthen their organization's identity and access security posture. It can further be extended for B2B accounts lifecycle management, which for the most part, is ungoverned with the default offerings/settings.
We would like to request the product team to consider this feature request and help prioritize this for the Microsoft Azure customers. Thank you.
