For context, I am a one person security team as a ISM. Other IT departments are Network, Systems, and Customer service that are under a completely different direction. There has a small about of push-back when I speak on access management roles/responsibilities and separation of duties. What are some opinions on what is the best take on access management ownership with AD and Entra ID, and other services?

670 viewscircle icon1 Comment
Sort by:
IT Analyst6 months ago

If you are having resistance about it, I think the first step is to engage higher organization levels showing evolved risks. If you get green sign of them next steps are:
1) training teams about security and risks;
2) review organization's security policy;
  2.1) maybe create a standard about IAM's administration;
3) implement IAM policy

There is no formula about which team should do what, each organizations has its own way of working. It isn't a question of organizational chart, it's a question of resposibility. The most important thing is to ensure teams are aware of the their roles in the security implications.

Content you might like

Yes74%

No26%

No action taken7%

Extra training required by user 95%

Permissions revoked5%

Disciplinary action taken against user3%

View Results