User Role Assignments Report

Often, while preparing for periodical security audits, IT administrators need to provide evidence of how access to critical resources is controlled and who has elevated permissions within the Microsoft Entra ID environment. Also, administrators have to identify and remediate any unnecessary or risky role assignments within the target environment. To aid administrators in identifying such role assignments, eG Enterprise offers the User Role Assignments report. Using this report administrators can obtain a clear overview of which users have been assigned to specific roles, and easily ensure if permissions align with job responsibilities and adhere to the principle of least privilege. This report also helps administrators identify and revoke excessive or outdated access rights, detect potential security risks. Also, this report offers administrators a proactive approach to identity governance and reduces the likelihood of unauthorized access to sensitive resources. This way, administrators can seamlessly prepare for audits thus ensuring traceability and accountability.

To generate the report, do the following:

Select the User Role Assignments option by following the menu sequence: REPORTS BY FUNCTION -> Domain-specific Reports -> Microsoft Entra ID -> Users.
Figure 1 then appears. In Figure 1, select a criteria for analysis from the Analyze By list box.

Figure 1 : Specifying the criteria for generating the User Role Assignments report
Using this report, you can analyze the roles assigned to users belonging to one/more managed components, or those that are part of a zone, service or segment. The options provided by the Analyze By list box are discussed hereunder:
- Component: Select this option to choose the component(s) from across all the managed components in the environment.
- Zone: To generate a report for one/more components that are included in a zone, pick the Zone option. A Zone drop-down list will then appear, from which you would have to select the zone to which the components of interest to you belong. A Sub zone flag also appears. Indicate whether the components present within the sub-zones of the chosen zone are also to be to be considered for report generation, by setting the Sub zone flag to Yes.
- Segment: If you want to generate a report for one/more chosen components that belong to a segment, select the Segment option from Analyze By list box, and then pick the Segment from the drop-down list that appears.
- Service: If you want to generate a report for one/more components involved in the delivery of a service, select the Service option from Analyze By, and then pick the required Service from the drop-down list that appears.
By default, Microsoft Azure Entra ID option is chosen from the Component Type list.
The Components list will now be populated with all the components that are managed in your environment for the chosen component type. If the Components list consists of too many components, then viewing all the components and selecting the ones you need for report generation could require endless scrolling. To avoid this, you can click the button next to the Components list. A Components pop up window will then appear using which you can view almost all the components in a single interface and Select the ones to be included in this report.
By default, * is specified in the Users text box indicating that this report will be generated for all the users belonging to the target Microsoft Entra ID environment. However, if you wish to generate this report for a particular user, then, you can specify the name of the user against this text box. You can even specify a pattern in this text box. For example, specifying john* in this text box will generate this report for all the usernames that start with the name john.
By default, * is specified in the Role text box indicating that this report will be generated for all the roles assigned to the users in the target Microsoft Entra ID environment. However, if you wish to generate this report based on the role of your choice, then, you can specify the name of the role against this text box. You can even specify a pattern in this text box. For example, specifying Global* in this text box will generate this report based on the roles that start with the name Global.
By default, High option is chosen from the Privileged users list indicating that the report will be generated for only those users who are assigned with High privileged roles. However, if you wish to generate a report for all users, then, you can choose Both option from this list. Also, if you wish to generate a report on users with low privileged role alone, then you can pick the Low option from this list.
Then, specify the Timeline for generating this report. You can either provide a fixed time line such as 1 hour, 2 days, etc., or select the Any option from the list to provide a From and To date/time for report generation.

Note:

For every user registered with the eG Enterprise, the administrator can indicate the maximum timeline for which that user can generate a report. Once the maximum timeline is set for a user, then, whenever that user logs into eG Reporter and attempts to generate a report, the Timeline list box in the report page will display options according to the maximum timeline setting of that user. For instance, if a user can generate a report for a maximum period of 3 days only, then 3 days will be the highest option displayed in the Timeline list - i.e., 3 days will be the last option in the fixed Timeline list. Similarly, if the user chooses the Any option from the Timeline list and proceeds to provide a start date and end date for report generation using the From and To specifications, eG Enterprise will first check if the user's Timeline specification conforms to his/her maximum timeline setting. If not, report generation will fail. For instance, for a user who is allowed to generate reports spanning over a maximum period of 3 days only, the difference between the From and To dates should never be over 3 days. If it is, then, upon clicking the Run Report button a message box will appear, prompting the user to change the From and To specification.
In addition to the settings discussed above, this report comes with a set of default specifications. These settings are hidden by default. If you do not want to disturb these default settings, then you can proceed to generate the report by clicking the Run Report button soon after you pick one/more components for report generation. However, if you want to view and then alter these settings (if required), click on the icon. The default settings will then appear in the More Options drop down window (See Figure 2). The steps below discuss each of these settings and how they can be customized.

Figure 2 : The default settings for generating the report
Next, indicate the report Time period.

Note:

By default, the Time period is set to 24 hours. Accordingly, the From and To parameters in the [timeframe] section of the eg_report.ini file (in the <eg_install_dir>\manager\config directory) are set to 00:00 and 24:00 respectively. If need be, you can override this default setting by configuring a different timeframe against the From and/or To parameters.
In large environments, reports generated using months of data can take a long time to complete. Administrators now have the option of generating reports on-line or in the background. When a report is scheduled for background generation, administrators can proceed with their other monitoring, diagnosis, and reporting tasks, while the eG manager is processing the report. This saves the administrator valuable time. To schedule background processing of a report, you can either select the Background Save - PDF option or the Background Save - CSV option from the Report Generation list. To process reports in the foreground, select the Foreground Generation - HTML option from this list.

Note:
- The Report Generation list will appear only if the EnableBackgroundReport flag in the [BACKGROUND_PROCESS] section of the eg_report.ini file (in the <EG_INSTALL_DIR>\manager\config directory) is set to Yes.
- The default selection in the Report Generation list will change according to the Timeline specified for the report. If the Timeline set is greater than or equal to the number of days specified against the MinDurationForReport parameter in the [BACKGROUND_PROCESS] section of the eg_report.ini file, then the default selection in the Report Generation list will be Background Save - PDF. On the other hand, if the Timeline set for the report is lesser than the value of the MinDurationForReport parameter, then the default selection in the Report Generation list will be Foreground. This is because, the MinDurationForReport setting governs when reports are to be processed in the background. By default, this parameter is set to 2 weeks - this indicates that by default, reports with a timeline of 2 weeks and above will be processed in the background.
Click the Done button once you have made the necessary changes to the More Options drop down window.
Finally, click the Run Report button to generate the report.
If the Report Generation is Foreground Generation - HTML and the default High option is chosen from the Privileged users list, then Figure 3 will appear as soon as you click the Run Report button.

Figure 3 : The generated User Role Assignments Report

The generated report contains the following sections:
- The Summary section (see Figure 3) reveals the total users belonging to the target Microsoft Entra ID over a chosen period of time, the count of active/inactive users and the count of users who have not signed in since their credentials were created, count of high privilege roles assigned, the percentage of high privilege roles and the count of global administrators in the target Microsoft Entra ID over a chosen period of time.
- The Configured High Privileged Roles section (see Figure 3) reveals the name of the high privileged roles configured in the target Microsoft Entra ID environment over a period of time.
- The User Role Assignments section (see Figure 3) reveals the name of each user, the email ID of the user, the count of high privileged roles assigned to the user, the count of low privileged users assigned to the user and the name of the roles over a period of time.
  
  Expanding the right arrow button that appears preceding each user in the USER NAME column of Figure 3 will reveal Figure 4.
  
  Figure 4 : Expanding the user in the generated report
  
  Using Figure 4, administrators can easily figure out the roles that are assigned to the chosen user, identify whether/not the role assigned is a high privilege role and the description of the role assigned.
If the Report Generation is Foreground Generation - HTML and Both option is chosen from the Privileged users list, then Figure 5 will appear as soon as you click the Run Report button.

Figure 5 : The generated report when Both option is chosen from the Privileged users list

In Figure 5, the User Role Assignments section will reveal the name of the users who are assigned with both high and low privileges over a chosen period of time.