Role-based Access Controls (RBAC)

Onboarding RBAC Account Groups

Overview:

Using Role Based Access Controls (RBAC) to manage permissions can greatly reduce the time, effort and complexity required to:

Adapt to staffing and role changes, including seasonal increases
Increased data security & consistency
Simplify reporting, auditing, and compliance. (Who has access to what)

RBAC uses a two tier approach of managing Role and Access Group membership. Resource owners can now easily manage the membership of these group(s) instead of assigning complicated and time consuming access list permissions. At a glance, resource owners can see who has permission to their Shared Resources and Modify the membership accordingly without ITS intervention.

The basic principles of RBAC are to:

Create a Shared Resource
Create an Access Group
Create a Role Group
Assign the Access Group permission against the Shared Resource
Assign the Role Group as a member of the Access Group
Assign members to the Role Group

A shared resource is a resource that needs access by one or many users. Examples of shared resources are: Shared Folder(s), Exchange Shared Mailboxes, Printer(s).
ITS will create the shared Resource(s).

Benefits:

The core benefit from an end user perspective is self management regarding access to a department’s shared resources. So, if an employee starts a new job or leaves a job it is the role of the Manager / Leader / Designate to remove or allow access to the shared resources. With RBAC this access is granted or removed by simply adding or removing them as a member of the group.

Example: Onboarding

Sally A comes to work for the information Technology Department. Sally’s Manager is Bob B.
Sally A has the role of Network Analyst. Sally will need access to the IT department’s Shared Folder ITS2
The Access Groups and Role Groups are already defined (see picture below).
All Sally’s Manager Bob has to do is add Sally as a member to the ROLE_ITS_NSA role group.
Sally now has all the permissions needed – the same as other members of the Role Group ROLE_ITS_NSA

Example: Job Change

Sally A who was working in ITS now has a job in Human Resources. Sally should no longer have access to the shared Resource ITS2. She should only have access to the shared Resource HR.
Sally A’s old manager was Bob B.
Sally A’s new manager is Karen C.
Sally’s old manager will remove her as a member of ROLE_ITS_NSA. Effectively removing her access to the shared Resource ITS2.
Sally’s new manager will add her as a member to ROLE_HR_ADMIN. Effectively giving her access to the shared Resource HR.

Group membership:

Group membership can be managed by the OPI / Leaders / Designate / Owner of the Shared Resource by using the following:

Start – Computer – Network – Search Active Directory

From here you can type in ROLE_ to find all the different Role Groups in the college that can be reused or the one(s) created for your department.

From here you can also type in AG_ to find the different Access Groups in the college that can be reused or the one(s) created for your department.

If you have permission to modify the membership of the group – you can double click on the group and you will have an option to add or delete users / groups from the membership. If you do not have permission these options will be greyed out. However, you can still view the members of the group.

Managing File Permissions:

The help contents provided by Microsoft can help explain what each permission does and where to apply it.

To access the help, feature of Managing File permissions – Right Click on any of the folders you own and select properties. Select the security Tab. Click on the Learn about access control and permissions.