Episode 436: Finding the Entra Tenants You Didn't Know You Had

WEBVTT
1
00:00:03.359 --> 00:00:05.919
- Welcome to episode 436
2
00:00:05.919 --> 00:00:09.039
- of the Microsoft Cloud IT Pro podcast recorded
3
00:00:09.039 --> 00:00:11.699
- live on 09/07/2026.
4
00:00:11.839 --> 00:00:14.025
- This is a show about Microsoft three sixty
5
00:00:14.025 --> 00:00:16.184
- five and Azure from the perspective of IT
6
00:00:16.184 --> 00:00:18.344
- pros and end users, where we discuss the
7
00:00:18.344 --> 00:00:20.744
- topic or recent news and how it relates
8
00:00:20.744 --> 00:00:22.045
- to you. Microsoft
9
00:00:22.425 --> 00:00:25.945
- Entra tenant governance is the topic today. Almost
10
00:00:25.945 --> 00:00:30.019
- nobody runs one Microsoft Entra tenant. Mergers, divestitures,
11
00:00:30.559 --> 00:00:33.520
- dev and test environments, regional partitioning, and that
12
00:00:33.520 --> 00:00:36.239
- one AI proof of concept somebody spun up
13
00:00:36.239 --> 00:00:39.840
- on a credit card. Organizations accumulate tenants like
14
00:00:39.840 --> 00:00:42.045
- the way they accumulate SharePoint sites.
15
00:00:42.445 --> 00:00:44.765
- The difference is that nobody ever built an
16
00:00:44.765 --> 00:00:47.424
- inventory of the tenants, and central IT frequently
17
00:00:47.564 --> 00:00:49.804
- cannot name them, let alone say whether they
18
00:00:49.804 --> 00:00:53.405
- are configured safely. Microsoft Entra tenant governance is
19
00:00:53.405 --> 00:00:57.119
- now generally available in Microsoft's first party answer.
20
00:00:57.259 --> 00:00:59.839
- Today, Ben and Scott dive into the requirements,
21
00:01:00.140 --> 00:01:02.479
- features, and functionality that it includes.
22
00:01:04.939 --> 00:01:07.579
- Oh, Scott, it's a Tuesday morning that feels
23
00:01:07.579 --> 00:01:09.979
- like a Monday morning. It's what happens after
24
00:01:09.979 --> 00:01:13.104
- a holiday. Yes. For a holiday, sick kids.
25
00:01:13.405 --> 00:01:15.805
- You don't care about it. Bizarre football games
26
00:01:15.805 --> 00:01:17.564
- over Labor Day weekend. Labor Day in The
27
00:01:17.564 --> 00:01:19.004
- United States. Do you feel like a laborer?
28
00:01:19.004 --> 00:01:20.604
- I felt like a laborer because I actually
29
00:01:20.604 --> 00:01:22.685
- worked yesterday. I labored on Labor Day. Does
30
00:01:22.685 --> 00:01:25.084
- that mean I appropriately celebrated it? I drove
31
00:01:25.084 --> 00:01:26.799
- on Labor Day, and
32
00:01:27.100 --> 00:01:27.920
- I had to
33
00:01:28.460 --> 00:01:31.740
- drive through Atlanta, and that was labor. Was
34
00:01:31.740 --> 00:01:34.380
- Atlanta I mean, I asked if Atlanta was
35
00:01:34.380 --> 00:01:36.859
- bad, but Atlanta's always bad. I feel like
36
00:01:36.859 --> 00:01:38.395
- it would have been a little better on
37
00:01:38.395 --> 00:01:40.075
- Labor Day, or was it everybody coming home
38
00:01:40.075 --> 00:01:41.674
- from the mountains? It well, it was everybody
39
00:01:41.674 --> 00:01:44.395
- coming home, everybody going back, and all the
40
00:01:44.395 --> 00:01:44.895
- usual
41
00:01:45.355 --> 00:01:46.495
- accident traps.
42
00:01:46.875 --> 00:01:49.115
- There's this thing that seems to be happening
43
00:01:49.115 --> 00:01:51.615
- more and more, and I don't understand why.
44
00:01:51.835 --> 00:01:53.490
- So I got end up, you know, how
45
00:01:53.490 --> 00:01:55.329
- you end up in the butterfly effect of
46
00:01:55.329 --> 00:01:57.250
- just cars going slow, so slow, and then
47
00:01:57.250 --> 00:01:58.930
- they start going fast? Yeah. Like, they have
48
00:01:58.930 --> 00:02:00.849
- videos of that, like, of a circle and
49
00:02:00.849 --> 00:02:02.130
- one person, and all of a sudden you
50
00:02:02.130 --> 00:02:03.810
- end up with a traffic jam for absolutely
51
00:02:03.810 --> 00:02:06.709
- no reason. In Atlanta, those butterfly effects are
52
00:02:06.930 --> 00:02:10.514
- not 500 feet or, like, half a mile.
53
00:02:10.514 --> 00:02:11.735
- They tend to go for miles.
54
00:02:12.034 --> 00:02:14.914
- Sometimes ten, twenty miles of just, like, what
55
00:02:14.914 --> 00:02:16.114
- is going on? And then all of a
56
00:02:16.114 --> 00:02:18.354
- sudden, traffic just rubber bands out. So the
57
00:02:18.354 --> 00:02:20.439
- thing that was doing it yesterday is in
58
00:02:20.439 --> 00:02:20.939
- Atlanta,
59
00:02:21.239 --> 00:02:22.379
- most of the highways
60
00:02:22.840 --> 00:02:23.340
- are,
61
00:02:23.799 --> 00:02:25.340
- what, like, five lanes,
62
00:02:25.799 --> 00:02:28.359
- six lanes? Yeah. At least. Yep. They eventually
63
00:02:28.359 --> 00:02:30.439
- get down to may maybe, like, three, four
64
00:02:30.439 --> 00:02:32.439
- lanes on each side of the highway. And
65
00:02:32.439 --> 00:02:33.099
- the Georgia
66
00:02:33.425 --> 00:02:36.224
- State Highway Patrol was out in force yesterday.
67
00:02:36.224 --> 00:02:37.585
- Makes sense. Right? Lots of people on the
68
00:02:37.585 --> 00:02:39.824
- road. Hey. Let's go over. Get people for
69
00:02:39.824 --> 00:02:41.925
- infractions, for speeding, whatnot.
70
00:02:42.224 --> 00:02:44.064
- But every person that they were pulling over,
71
00:02:44.064 --> 00:02:45.360
- they would pull them over on the right,
72
00:02:45.439 --> 00:02:46.960
- and they'd be off, like, well into the
73
00:02:46.960 --> 00:02:48.800
- median. But what was happening was you'd have
74
00:02:48.800 --> 00:02:50.560
- three lanes of traffic, and everybody would be
75
00:02:50.560 --> 00:02:52.400
- trying to move over to give that cop
76
00:02:52.400 --> 00:02:54.319
- some room or around whatever they were doing,
77
00:02:54.319 --> 00:02:56.879
- and it would cause these massive backups. Like,
78
00:02:56.879 --> 00:02:58.719
- just every single time Saudi was getting pulled
79
00:02:58.719 --> 00:03:01.344
- over, and holiday in The United States, everybody's
80
00:03:01.344 --> 00:03:03.584
- getting pulled over all the time because they
81
00:03:03.584 --> 00:03:05.025
- can't get out of their own way. It
82
00:03:05.025 --> 00:03:06.944
- was just a ton of that. And to
83
00:03:06.944 --> 00:03:08.625
- the point where you were thinking, like, every
84
00:03:08.625 --> 00:03:10.224
- time, like, I passed when like, I was
85
00:03:10.224 --> 00:03:11.504
- going past this one, it was, like, a
86
00:03:11.504 --> 00:03:13.604
- a tractor trailer that had been pulled over.
87
00:03:13.780 --> 00:03:15.860
- I thought, like, the cop was gonna cause
88
00:03:15.860 --> 00:03:18.419
- more accidents by people trying to pull around
89
00:03:18.419 --> 00:03:20.099
- him based on, like, the angle that he
90
00:03:20.099 --> 00:03:21.780
- had parked in there. And it's not like
91
00:03:21.780 --> 00:03:23.539
- he wasn't he was in the median, but
92
00:03:23.539 --> 00:03:25.699
- he was parked at an angle. Like, he
93
00:03:25.699 --> 00:03:27.219
- was a little squirrelly. He wasn't straight. And
94
00:03:27.219 --> 00:03:29.055
- that was just throwing everybody off to, like,
95
00:03:29.055 --> 00:03:31.055
- swerve at the last second and get around
96
00:03:31.055 --> 00:03:32.734
- him and get over into this other lane.
97
00:03:32.734 --> 00:03:34.814
- And it just caused these, like, massive backups.
98
00:03:34.814 --> 00:03:37.055
- So, yeah, the usual seven hour trip took
99
00:03:37.055 --> 00:03:40.094
- about nine hours because of Nine hours because
100
00:03:40.094 --> 00:03:43.260
- of everybody governing the traffic. That's it. The
101
00:03:43.260 --> 00:03:46.400
- governor governable becomes ungovernable becomes governable.
102
00:03:46.860 --> 00:03:47.980
- Here we go. Here we go. There we
103
00:03:47.980 --> 00:03:49.280
- go. That's your transition.
104
00:03:49.900 --> 00:03:52.080
- There's my transition into the ungovernable
105
00:03:53.740 --> 00:03:54.639
- becoming governable.
106
00:03:55.020 --> 00:03:58.034
- Only this time, it's not traffic. It's entry
107
00:03:58.034 --> 00:04:00.754
- tenants. Entry tenants. Entry tenant Enter tenants.
108
00:04:01.474 --> 00:04:04.294
- Governance, which is Yes. Can you imagine unmanaged
109
00:04:04.834 --> 00:04:07.234
- entry tenants? That never happens. Right? I mean,
110
00:04:07.234 --> 00:04:07.894
- it does.
111
00:04:08.594 --> 00:04:11.479
- Absolutely. It does. We're gonna talk intro tenant
112
00:04:11.479 --> 00:04:13.099
- governance today, which recently
113
00:04:13.400 --> 00:04:16.930
- GA'd. Yes. Back in August, I think, August
114
00:04:16.930 --> 00:04:17.419
- 10
115
00:04:18.199 --> 00:04:18.699
- ish,
116
00:04:19.000 --> 00:04:21.479
- August 11, that time frame. So beginning of
117
00:04:21.479 --> 00:04:24.134
- August of this year. This hit GA, and
118
00:04:24.214 --> 00:04:25.754
- it's interesting. I can't remember
119
00:04:26.214 --> 00:04:28.395
- when this previewed. Like, I kinda remember
120
00:04:28.775 --> 00:04:32.134
- hearing talk about it, seeing it. We've never
121
00:04:32.134 --> 00:04:35.574
- talked about it. And I was looking through
122
00:04:35.574 --> 00:04:37.495
- all of our notes of past episodes, and
123
00:04:37.495 --> 00:04:38.935
- it was like, what should we talk about?
124
00:04:38.935 --> 00:04:41.829
- It's, oh, this tenant governance GA. This seems
125
00:04:41.829 --> 00:04:44.149
- like something we should talk about and something
126
00:04:44.149 --> 00:04:46.550
- we should discuss. It kinda goes along with
127
00:04:46.550 --> 00:04:48.389
- some of the other topics we've had around
128
00:04:48.389 --> 00:04:49.610
- mergers, divestitures,
129
00:04:50.870 --> 00:04:52.329
- dev tenants, testing,
130
00:04:52.949 --> 00:04:54.329
- all of that is
131
00:04:54.955 --> 00:04:56.415
- how do you go about
132
00:04:57.275 --> 00:04:57.775
- governing
133
00:04:58.235 --> 00:05:01.675
- tenants that really could happen for any number
134
00:05:01.675 --> 00:05:03.694
- of reasons within an organization?
135
00:05:04.154 --> 00:05:06.715
- I know, like myself, I have some. I
136
00:05:06.715 --> 00:05:08.314
- have a test one. I have one that
137
00:05:08.314 --> 00:05:10.335
- I use sometimes when I
138
00:05:10.930 --> 00:05:13.970
- do some training because I don't always wanna
139
00:05:13.970 --> 00:05:16.449
- show my production tenant, although sometimes I do
140
00:05:16.449 --> 00:05:18.870
- just for data reasons. Other organizations,
141
00:05:19.250 --> 00:05:21.750
- they may have employees that just
142
00:05:22.129 --> 00:05:25.404
- spin up tenants for testing something because they
143
00:05:25.404 --> 00:05:27.085
- wanna do something they can't do in their
144
00:05:27.085 --> 00:05:30.305
- tenant. I do have clients that have actual
145
00:05:30.525 --> 00:05:32.525
- development tenants. They wanna be able to have
146
00:05:32.525 --> 00:05:35.025
- a separate tenant other than production that they're
147
00:05:35.165 --> 00:05:36.705
- testing stuff in, creating
148
00:05:37.180 --> 00:05:37.680
- custom
149
00:05:38.220 --> 00:05:40.079
- SPFX web web parts,
150
00:05:40.539 --> 00:05:41.759
- creating custom
151
00:05:42.139 --> 00:05:45.659
- add ins, just creating their own features. All
152
00:05:45.659 --> 00:05:47.759
- of those different things can
153
00:05:48.060 --> 00:05:49.899
- lead to tenants or, like we said, people
154
00:05:49.899 --> 00:05:52.444
- are merging. You acquire a company, you have
155
00:05:52.605 --> 00:05:54.125
- they have a tenant, now you have a
156
00:05:54.125 --> 00:05:56.785
- tenant, now you have multiple tenants.
157
00:05:57.245 --> 00:05:59.404
- Whether you are going to bring them together
158
00:05:59.404 --> 00:06:00.785
- or not, you would inevitably
159
00:06:01.165 --> 00:06:03.245
- end up with multiple tenants you're trying to
160
00:06:03.245 --> 00:06:03.745
- manage
161
00:06:04.060 --> 00:06:06.220
- at some point in time in a merger
162
00:06:06.220 --> 00:06:09.680
- where both companies already have tenants. So this
163
00:06:10.060 --> 00:06:11.839
- kinda has a bunch of features,
164
00:06:12.459 --> 00:06:13.759
- different things related
165
00:06:14.699 --> 00:06:15.919
- to those different topics
166
00:06:16.524 --> 00:06:18.464
- and or those different scenarios
167
00:06:18.925 --> 00:06:22.045
- and kinda some features and how you can
168
00:06:22.045 --> 00:06:25.485
- start thinking about this, managing this, discovering it,
169
00:06:25.485 --> 00:06:26.225
- and even
170
00:06:26.764 --> 00:06:29.485
- in a way, managing both from a single
171
00:06:29.485 --> 00:06:30.704
- pane of glass, although
172
00:06:31.004 --> 00:06:33.279
- that one, it's getting there, I would say.
173
00:06:33.279 --> 00:06:35.360
- Some of these features, it's GA'd, but I
174
00:06:35.360 --> 00:06:37.919
- feel like there's still some features and some
175
00:06:37.919 --> 00:06:40.560
- things to work through. Continues to mature over
176
00:06:40.560 --> 00:06:42.879
- time. I think the thing that always gets
177
00:06:42.879 --> 00:06:43.779
- me is
178
00:06:44.444 --> 00:06:47.185
- in the world of things like
179
00:06:47.564 --> 00:06:50.044
- Microsoft 365, I guess, I'd I'd be a
180
00:06:50.044 --> 00:06:53.084
- little pedantic there. Like, mergers and acquisitions happen,
181
00:06:53.084 --> 00:06:54.844
- but they don't happen every day. So, like,
182
00:06:54.844 --> 00:06:56.784
- do you need a product like this for
183
00:06:56.925 --> 00:06:57.745
- every day?
184
00:06:58.284 --> 00:07:00.670
- I don't know. Not for that particular scenario,
185
00:07:00.670 --> 00:07:02.189
- but the one that always gets me is
186
00:07:02.430 --> 00:07:04.830
- and I'm certainly colored by this, and I
187
00:07:04.830 --> 00:07:06.270
- imagine you've got a little bit of bias
188
00:07:06.270 --> 00:07:10.270
- here too, is things like companies who participate
189
00:07:10.270 --> 00:07:13.389
- in the broader Microsoft ecosystem. So say you
190
00:07:13.389 --> 00:07:15.824
- go out and like, in your case, you're
191
00:07:15.824 --> 00:07:18.724
- a partner, and you get Visual Studio enterprise
192
00:07:18.785 --> 00:07:22.064
- licenses or the Microsoft Azure Visual Studio licenses,
193
00:07:22.064 --> 00:07:23.904
- whatever they are now. Hey. Guess what? Every
194
00:07:23.904 --> 00:07:25.904
- one of those comes with an entry tenant.
195
00:07:25.904 --> 00:07:27.425
- So, you know, if you're an organization and
196
00:07:27.425 --> 00:07:30.430
- you've got 500 developers, guess what? You have
197
00:07:30.430 --> 00:07:31.310
- 501
198
00:07:31.310 --> 00:07:33.550
- tenants out there to go and manage and
199
00:07:33.550 --> 00:07:35.589
- go and think about. So that that's where
200
00:07:35.589 --> 00:07:37.310
- I think things like this are helpful is
201
00:07:37.310 --> 00:07:39.550
- just for, like, the dev test sprawl, like
202
00:07:39.550 --> 00:07:41.324
- you said, is kind of, like, the the
203
00:07:41.324 --> 00:07:43.404
- biggest thing that would be out there. And
204
00:07:43.404 --> 00:07:45.644
- certainly helpful in, like, the, hey. Let me
205
00:07:45.644 --> 00:07:48.444
- understand where maybe even not from, like, a
206
00:07:48.444 --> 00:07:50.524
- m and a perspective, but from just a
207
00:07:50.524 --> 00:07:51.745
- a pure discoverability.
208
00:07:52.125 --> 00:07:53.105
- Like, let me understand
209
00:07:53.485 --> 00:07:56.519
- the tenants that are bound to my tenant
210
00:07:56.519 --> 00:07:58.759
- or that I work with either on an
211
00:07:58.759 --> 00:08:01.560
- inbound, off outbound, like, auth and auth c,
212
00:08:01.560 --> 00:08:03.639
- kinda kinda flow. We were talking about this
213
00:08:03.639 --> 00:08:05.180
- before we started recording.
214
00:08:05.639 --> 00:08:07.019
- And things like
215
00:08:07.334 --> 00:08:07.995
- visibility into
216
00:08:09.095 --> 00:08:11.654
- what are the Microsoft tenants that you interact
217
00:08:11.654 --> 00:08:14.074
- with, maybe through, like, a managed service, like
218
00:08:14.295 --> 00:08:16.774
- Windows three sixty five, like Cloud PCs or
219
00:08:16.774 --> 00:08:18.615
- things like that. So you can get that
220
00:08:18.615 --> 00:08:20.375
- level of visibility there as well. I would
221
00:08:20.375 --> 00:08:23.259
- say that was the interesting part to me
222
00:08:23.279 --> 00:08:25.879
- because in typical IT admin fashion, I went
223
00:08:25.879 --> 00:08:28.040
- in here and just started clicking buttons without
224
00:08:28.040 --> 00:08:30.040
- reading all of the documentation on how some
225
00:08:30.040 --> 00:08:31.420
- of it works. And
226
00:08:31.800 --> 00:08:33.100
- one of the first ones
227
00:08:33.480 --> 00:08:33.980
- was
228
00:08:34.360 --> 00:08:35.019
- this related
229
00:08:35.399 --> 00:08:35.899
- tenants
230
00:08:36.294 --> 00:08:38.774
- feature of tenant governance. And this goes into
231
00:08:38.774 --> 00:08:40.634
- what you were just talking about where
232
00:08:41.014 --> 00:08:42.774
- I had tenant governance, I went into related
233
00:08:42.774 --> 00:08:44.695
- tenants, and I had a button that's like
234
00:08:44.695 --> 00:08:47.495
- discover related tenants. Sure. Great. Let's click it,
235
00:08:47.495 --> 00:08:49.440
- see what it does. It goes off and
236
00:08:49.440 --> 00:08:51.039
- I think it said it might take, like,
237
00:08:51.039 --> 00:08:53.120
- twenty four or forty eight hours. It can
238
00:08:53.120 --> 00:08:56.240
- take some time. It's measured in hours or
239
00:08:56.240 --> 00:09:00.080
- days, not in minutes. And then it comes
240
00:09:00.080 --> 00:09:02.259
- back with all of these tenants
241
00:09:02.865 --> 00:09:05.904
- that are in some form or fashion related
242
00:09:05.904 --> 00:09:07.825
- to your tenant, and it looks for different
243
00:09:07.825 --> 00:09:11.184
- signals. So it'll look for things like b
244
00:09:11.184 --> 00:09:13.845
- to b registration. So where do I have
245
00:09:14.065 --> 00:09:14.304
- a
246
00:09:15.110 --> 00:09:17.190
- that b to b registration set up? Like,
247
00:09:17.190 --> 00:09:19.290
- it could be the cross tenant sync stuff.
248
00:09:19.590 --> 00:09:21.529
- Those various aspects of
249
00:09:21.990 --> 00:09:23.129
- that b to b implementation.
250
00:09:23.590 --> 00:09:25.190
- It has b to b sign in, which
251
00:09:25.190 --> 00:09:25.690
- tenants
252
00:09:26.230 --> 00:09:29.215
- are their guest accounts set up with. Multi
253
00:09:29.215 --> 00:09:31.934
- tenant application. So this was one that showed
254
00:09:31.934 --> 00:09:33.455
- up in mind that I didn't really think
255
00:09:33.455 --> 00:09:36.115
- about before is tenants that have
256
00:09:36.575 --> 00:09:37.955
- that belong to companies
257
00:09:38.414 --> 00:09:40.115
- that have created applications
258
00:09:40.839 --> 00:09:41.659
- that you
259
00:09:41.960 --> 00:09:42.620
- may purchase
260
00:09:43.159 --> 00:09:46.059
- or that are free that you then register
261
00:09:46.519 --> 00:09:49.159
- that enterprise app in your tenant. It discovers
262
00:09:49.159 --> 00:09:51.080
- that, then it has things like admin app
263
00:09:51.080 --> 00:09:54.379
- sign ins and billing. So in my related
264
00:09:54.440 --> 00:09:57.574
- tenants, I don't I probably have I don't
265
00:09:57.574 --> 00:09:59.495
- know. I probably have 50 different tenants in
266
00:09:59.495 --> 00:10:01.894
- here that showed up in related tenants, and
267
00:10:01.894 --> 00:10:03.274
- it's things like
268
00:10:03.654 --> 00:10:05.754
- third party solutions that I use. So
269
00:10:06.134 --> 00:10:08.235
- Syskit, One Place Solutions, Freshdesk,
270
00:10:08.615 --> 00:10:09.115
- Calendly,
271
00:10:09.495 --> 00:10:09.995
- SavvyCal,
272
00:10:11.070 --> 00:10:13.629
- run events because I use my Microsoft three
273
00:10:13.629 --> 00:10:16.509
- sixty five login or run events for speaking
274
00:10:16.509 --> 00:10:17.250
- at sessions.
275
00:10:17.629 --> 00:10:19.549
- All of those show up because all of
276
00:10:19.549 --> 00:10:22.450
- those, they have multi tenant applications
277
00:10:23.034 --> 00:10:25.375
- that I've set up and installed in my
278
00:10:25.434 --> 00:10:27.774
- environment. And I think this is one interesting
279
00:10:27.835 --> 00:10:30.554
- one too even from a to your point,
280
00:10:30.554 --> 00:10:33.195
- mergers don't happen every day, but companies are
281
00:10:33.195 --> 00:10:35.615
- always adding enterprise apps to their environment.
282
00:10:35.919 --> 00:10:38.160
- And just being aware of what are these
283
00:10:38.160 --> 00:10:40.340
- tenants that are related to yours just
284
00:10:40.720 --> 00:10:42.879
- through enterprise apps that have been set up.
285
00:10:42.879 --> 00:10:44.160
- That was one, but then it does have
286
00:10:44.160 --> 00:10:45.840
- a bunch of my customer tenants. It has
287
00:10:45.840 --> 00:10:48.720
- some of my test tenants, dev tenants, and
288
00:10:48.720 --> 00:10:51.360
- it flags what is that discovery signal. Is
289
00:10:51.360 --> 00:10:53.575
- it a tenant because it's multi tenant, because
290
00:10:53.575 --> 00:10:54.794
- it's b two b registration,
291
00:10:55.414 --> 00:10:55.914
- billing,
292
00:10:56.375 --> 00:10:58.375
- all of those? And you can just scan
293
00:10:58.375 --> 00:11:00.714
- through this entire list of tenants
294
00:11:01.095 --> 00:11:01.914
- and see
295
00:11:02.454 --> 00:11:04.054
- what is it and how is it related
296
00:11:04.054 --> 00:11:06.240
- to you, and then click into it and
297
00:11:06.240 --> 00:11:08.960
- see information. So there was one that also
298
00:11:08.960 --> 00:11:11.940
- flags Microsoft managed tenants, and I had
299
00:11:12.320 --> 00:11:13.460
- one that was
300
00:11:14.399 --> 00:11:16.320
- MS Azure cloud. I was like, what is
301
00:11:16.320 --> 00:11:18.879
- MS Azure cloud? I don't recognize it, don't
302
00:11:18.879 --> 00:11:20.925
- know what it is. It's just a multi
303
00:11:20.925 --> 00:11:21.745
- tenant application.
304
00:11:22.125 --> 00:11:24.524
- And I went into Discovery Signals. Once I
305
00:11:24.524 --> 00:11:26.684
- clicked on that application, I can see the
306
00:11:26.684 --> 00:11:27.585
- inbound applications,
307
00:11:27.965 --> 00:11:30.605
- and it was my Windows Virtual Desktop client
308
00:11:30.605 --> 00:11:33.240
- and Windows Virtual Desktop. Given that, I'm assuming
309
00:11:33.240 --> 00:11:35.240
- this is just where Windows three sixty five
310
00:11:35.240 --> 00:11:37.399
- Cloud PCs are hosted since those are the
311
00:11:37.399 --> 00:11:38.379
- only two applications,
312
00:11:38.759 --> 00:11:41.000
- but it does give you some of those
313
00:11:41.000 --> 00:11:42.059
- additional details
314
00:11:42.679 --> 00:11:44.600
- when you go into each of these tenants
315
00:11:44.600 --> 00:11:45.894
- too around
316
00:11:46.754 --> 00:11:48.754
- why does it think it's related and what
317
00:11:48.754 --> 00:11:50.054
- are those different
318
00:11:50.355 --> 00:11:52.674
- more details about those signals and why it
319
00:11:52.674 --> 00:11:54.595
- got pulled in. There's a bunch there. It
320
00:11:54.595 --> 00:11:55.815
- is nice that
321
00:11:56.835 --> 00:12:00.410
- that the Microsoft tenants get kind of a
322
00:12:00.410 --> 00:12:02.410
- little bit of special treatment there. So so
323
00:12:02.410 --> 00:12:05.129
- those Microsoft managed tenants, they get flagged that
324
00:12:05.129 --> 00:12:08.009
- way. So you can have the question about
325
00:12:08.009 --> 00:12:09.529
- it, but at least you know that it's
326
00:12:09.529 --> 00:12:12.009
- kind of a a trusted entity as it's
327
00:12:12.009 --> 00:12:14.554
- coming through. So you can kinda either say,
328
00:12:14.554 --> 00:12:16.634
- hey. I wanna dig in more, or I
329
00:12:16.634 --> 00:12:19.195
- just wanna filter that out because it's just
330
00:12:19.195 --> 00:12:22.394
- extra noise or chatter for me. So I
331
00:12:22.394 --> 00:12:24.235
- think it's it's kind of an interesting thing
332
00:12:24.235 --> 00:12:24.735
- because
333
00:12:25.514 --> 00:12:26.815
- the tenant governance
334
00:12:27.195 --> 00:12:27.595
- isn't
335
00:12:28.740 --> 00:12:30.740
- when you go and light this up and
336
00:12:30.740 --> 00:12:31.860
- turn it on, we should talk a little
337
00:12:31.860 --> 00:12:33.779
- bit about licensing and what it takes to
338
00:12:33.779 --> 00:12:35.460
- light it up and turn it on. But
339
00:12:35.460 --> 00:12:37.559
- when you do it, it's giving you this
340
00:12:37.700 --> 00:12:40.179
- inventory of tenants, but it's not necessarily an
341
00:12:40.179 --> 00:12:42.759
- inventory of tenants that you own.
342
00:12:43.074 --> 00:12:43.894
- It's all about
343
00:12:44.195 --> 00:12:46.274
- kinda things that you own, things that you
344
00:12:46.274 --> 00:12:48.454
- don't own, things that Microsoft owns,
345
00:12:48.754 --> 00:12:50.834
- might come from other entities that that you
346
00:12:50.834 --> 00:12:53.574
- have a business relationship with, things like that.
347
00:12:53.714 --> 00:12:55.714
- And it just helps you kinda build that
348
00:12:55.714 --> 00:12:57.014
- situational awareness
349
00:12:57.419 --> 00:12:59.839
- about who and what is
350
00:13:00.139 --> 00:13:02.320
- logging in where, when are they doing it,
351
00:13:02.379 --> 00:13:02.879
- and
352
00:13:03.339 --> 00:13:05.419
- what are they doing along the way. Like,
353
00:13:05.419 --> 00:13:07.839
- am I logging in with a user account
354
00:13:07.899 --> 00:13:10.059
- into your tenant that then spin that's then
355
00:13:10.059 --> 00:13:12.014
- being used to log into a Microsoft tenant
356
00:13:12.014 --> 00:13:15.375
- for something like a a DevBox or something
357
00:13:15.375 --> 00:13:18.014
- like that, or even just another website that's
358
00:13:18.014 --> 00:13:19.795
- out there, anything that happens
359
00:13:20.335 --> 00:13:22.415
- along the way. We should talk about licensing
360
00:13:22.415 --> 00:13:24.455
- real quick. So Sorry. I skipped that part.
361
00:13:24.575 --> 00:13:26.575
- Devil's always in the details with these things,
362
00:13:26.575 --> 00:13:29.289
- right, and kinda how they fall out and
363
00:13:29.289 --> 00:13:30.669
- come together. So
364
00:13:31.129 --> 00:13:31.769
- you've got
365
00:13:32.329 --> 00:13:33.470
- oh, let's see.
366
00:13:33.850 --> 00:13:34.350
- Licensing
367
00:13:34.809 --> 00:13:36.250
- is a a little bit of a weird
368
00:13:36.250 --> 00:13:38.589
- beast for this one. So if you're already
369
00:13:38.809 --> 00:13:41.370
- over in M 365
370
00:13:41.370 --> 00:13:43.215
- Land, so you've got, like, an e three,
371
00:13:43.215 --> 00:13:44.195
- an e five,
372
00:13:44.575 --> 00:13:47.394
- anything like that, those would come with
373
00:13:47.774 --> 00:13:50.115
- p one or p two licenses for Entre,
374
00:13:50.175 --> 00:13:52.335
- and they would get you a certain level
375
00:13:52.335 --> 00:13:52.995
- of access.
376
00:13:53.295 --> 00:13:55.075
- Or you can have an e seven,
377
00:13:55.440 --> 00:13:57.220
- which then comes with
378
00:13:57.679 --> 00:13:58.179
- Microsoft
379
00:13:58.480 --> 00:13:58.980
- IntraID
380
00:13:59.600 --> 00:14:02.240
- governance as well. What wasn't clear to me,
381
00:14:02.240 --> 00:14:03.279
- and I didn't have time to spend a
382
00:14:03.279 --> 00:14:04.480
- 10 and up, maybe you could tell me,
383
00:14:04.480 --> 00:14:07.360
- is IntraID governance yet another, like, separate entitlement
384
00:14:07.360 --> 00:14:08.995
- that I can go and purchase, or do
385
00:14:08.995 --> 00:14:10.615
- I have to pick it up through
386
00:14:11.634 --> 00:14:12.134
- the
387
00:14:12.595 --> 00:14:14.995
- through, like, a p one or or p
388
00:14:14.995 --> 00:14:16.995
- two? Or and, like, I guess you'd have
389
00:14:16.995 --> 00:14:18.034
- to pick it up through, like, an e
390
00:14:18.034 --> 00:14:19.554
- seven or something like that if it wasn't
391
00:14:19.554 --> 00:14:21.970
- separate because there's really nothing above a p
392
00:14:21.970 --> 00:14:24.929
- two. This gets even more interesting. There was
393
00:14:24.929 --> 00:14:26.149
- because there was
394
00:14:26.769 --> 00:14:28.549
- there still is EntraSweet,
395
00:14:29.009 --> 00:14:30.610
- which is actually above the p two. There
396
00:14:30.610 --> 00:14:33.009
- is EntraSweet. Yes. We which is out there.
397
00:14:33.009 --> 00:14:34.304
- But But it's really weird because when you
398
00:14:34.304 --> 00:14:35.904
- go and read the documentation, like, this isn't
399
00:14:35.904 --> 00:14:38.384
- called out as Entrezuite. It's specifically called out
400
00:14:38.384 --> 00:14:40.144
- as here's what you get for free, which
401
00:14:40.144 --> 00:14:41.824
- isn't a whole lot. Here's what you get
402
00:14:41.824 --> 00:14:43.264
- with p one and p two, which is
403
00:14:43.264 --> 00:14:44.865
- additive and more, and here's what you get
404
00:14:44.865 --> 00:14:47.745
- with ID governance. ID governance. And I think
405
00:14:47.745 --> 00:14:48.725
- ID governance,
406
00:14:49.160 --> 00:14:50.920
- it is an additional add on. And I
407
00:14:50.920 --> 00:14:53.019
- think so if I'm remembering
408
00:14:53.399 --> 00:14:55.500
- all of this right, ID governance
409
00:14:55.960 --> 00:14:57.879
- is and I found some documentation on it
410
00:14:57.879 --> 00:14:59.960
- too. ID governance was a step up from
411
00:14:59.960 --> 00:15:02.940
- ID p two, so you could absolutely have
412
00:15:03.184 --> 00:15:05.605
- an e five and try d p two
413
00:15:05.904 --> 00:15:07.684
- go buy the Entra governance
414
00:15:08.144 --> 00:15:10.725
- on top of p two. I think
415
00:15:11.105 --> 00:15:12.164
- Entra governance
416
00:15:13.264 --> 00:15:14.004
- is also
417
00:15:14.784 --> 00:15:17.120
- fully included in EntraSweet
418
00:15:17.660 --> 00:15:19.500
- where you wouldn't need that step up if
419
00:15:19.500 --> 00:15:20.399
- you had EntraSweet.
420
00:15:21.179 --> 00:15:22.860
- And then when they came out with the
421
00:15:22.860 --> 00:15:23.600
- e seven,
422
00:15:23.899 --> 00:15:25.279
- they included EntraSweet
423
00:15:25.820 --> 00:15:26.960
- in the e seven,
424
00:15:27.500 --> 00:15:28.000
- ergo,
425
00:15:28.379 --> 00:15:31.200
- you ended up with ID governance.
426
00:15:31.580 --> 00:15:33.975
- So it it's interesting in that I don't
427
00:15:33.975 --> 00:15:35.914
- believe you can add ID governance
428
00:15:36.375 --> 00:15:38.534
- to a p one because it's a step
429
00:15:38.534 --> 00:15:40.214
- up from a p two, so you have
430
00:15:40.214 --> 00:15:42.154
- to be at that p two level already
431
00:15:42.615 --> 00:15:43.595
- to add
432
00:15:43.975 --> 00:15:44.875
- ID governance
433
00:15:45.629 --> 00:15:46.129
- based
434
00:15:47.230 --> 00:15:49.710
- on my understanding of this. Clear as mud.
435
00:15:49.710 --> 00:15:51.649
- Right? Which is all to say. Good luck.
436
00:15:52.670 --> 00:15:53.170
- You'll
437
00:15:53.790 --> 00:15:54.529
- see what happens
438
00:15:55.070 --> 00:15:57.470
- along the way. And because those licenses are
439
00:15:57.470 --> 00:15:59.745
- for individuals and not for the whole tenant,
440
00:15:59.745 --> 00:16:02.304
- that also kinda does the muddy the water
441
00:16:02.304 --> 00:16:04.544
- thing. So your regular user might not need
442
00:16:04.544 --> 00:16:06.784
- this, but maybe you're, like, admins who need
443
00:16:06.784 --> 00:16:09.845
- to get into the enter admin center and
444
00:16:10.065 --> 00:16:11.985
- leverage this capability. Like, they would be the
445
00:16:11.985 --> 00:16:12.485
- ones
446
00:16:13.059 --> 00:16:14.600
- who would need those licenses
447
00:16:14.980 --> 00:16:16.980
- and the ability to come in and crank
448
00:16:16.980 --> 00:16:18.659
- some of this stuff up and turn it
449
00:16:18.659 --> 00:16:19.940
- on along the way. Moral of the story,
450
00:16:19.940 --> 00:16:22.179
- just about e sevens for everybody. Easy peasy.
451
00:16:22.179 --> 00:16:24.039
- Yeah. Licensing there is definitely
452
00:16:24.819 --> 00:16:28.625
- interesting from that perspective. And, again, some of
453
00:16:28.625 --> 00:16:31.424
- it is gonna depend. Like, you mentioned those
454
00:16:31.424 --> 00:16:33.764
- limits of 30 monitors
455
00:16:34.544 --> 00:16:37.985
- and 800 resources or tenants per day that
456
00:16:37.985 --> 00:16:38.644
- are included
457
00:16:39.345 --> 00:16:40.884
- within and this
458
00:16:41.264 --> 00:16:42.245
- this is interesting.
459
00:16:42.840 --> 00:16:44.440
- I should have read more about licensing on
460
00:16:44.440 --> 00:16:46.680
- this. It's it gives you the 30 monitors,
461
00:16:46.680 --> 00:16:49.639
- 800 resources per tenant per day for both
462
00:16:49.639 --> 00:16:51.240
- the p one and the p two, but
463
00:16:51.240 --> 00:16:52.920
- then when you jump up to that Entra
464
00:16:52.920 --> 00:16:55.340
- ID governance, the Entra Suite, the e seven,
465
00:16:55.800 --> 00:16:57.945
- you get that same base. So you still
466
00:16:57.945 --> 00:17:00.825
- get 30 monitors, 800 resources per day, but
467
00:17:00.825 --> 00:17:02.764
- then you get 10 additional resources
468
00:17:03.705 --> 00:17:04.845
- or days
469
00:17:05.224 --> 00:17:07.244
- resources per day per license.
470
00:17:07.785 --> 00:17:10.365
- So it's hard to tell from that, like,
471
00:17:10.700 --> 00:17:13.339
- if I just have one p two going
472
00:17:13.339 --> 00:17:14.779
- back to your early statement, if I just
473
00:17:14.779 --> 00:17:17.099
- have one p two, it sounds like you
474
00:17:17.099 --> 00:17:18.880
- could technically use this
475
00:17:19.180 --> 00:17:21.819
- with one p two for an admin as
476
00:17:21.819 --> 00:17:23.660
- long as you were under that 30 monitors
477
00:17:23.660 --> 00:17:26.079
- and that 800 resources per tenant per day
478
00:17:26.194 --> 00:17:28.134
- as long as nobody in the organization
479
00:17:28.755 --> 00:17:30.914
- was using other things that were required by
480
00:17:30.914 --> 00:17:33.474
- a p two. It doesn't sound like the
481
00:17:33.474 --> 00:17:35.015
- way I'm reading this
482
00:17:35.554 --> 00:17:37.634
- that every user has to have it. And
483
00:17:37.634 --> 00:17:39.335
- it does say license to the administrators
484
00:17:39.875 --> 00:17:42.460
- using the feature, not to every user for
485
00:17:42.460 --> 00:17:43.679
- those governance relationships.
486
00:17:44.140 --> 00:17:45.679
- So that's where
487
00:17:46.220 --> 00:17:48.940
- you could get started with this with just
488
00:17:48.940 --> 00:17:50.880
- a single license for one of your admins
489
00:17:51.099 --> 00:17:52.960
- based on how I'm reading all of Microsoft's
490
00:17:53.394 --> 00:17:53.894
- muddled
491
00:17:54.275 --> 00:17:57.335
- licensing documentation. It's another fun one, right, because
492
00:17:57.394 --> 00:17:59.714
- Entra by itself doesn't have anything to do
493
00:17:59.714 --> 00:18:02.214
- with m three sixty five or Azure, really.
494
00:18:02.515 --> 00:18:04.275
- But then you An IDP. So you're sit
495
00:18:04.275 --> 00:18:05.634
- in the middle, but now you've muddied the
496
00:18:05.634 --> 00:18:07.234
- waters because the very first thing you do
497
00:18:07.234 --> 00:18:09.095
- when you go and read that licensing article
498
00:18:09.154 --> 00:18:10.409
- is it starts talking to you in a
499
00:18:10.409 --> 00:18:12.829
- note about e threes, e fives,
500
00:18:13.929 --> 00:18:14.829
- things like that.
501
00:18:15.130 --> 00:18:17.549
- It doesn't even, like, start with Entra licensing.
502
00:18:17.609 --> 00:18:19.869
- It starts with m three sixty five licensing
503
00:18:20.250 --> 00:18:20.990
- and the inclusion
504
00:18:21.529 --> 00:18:23.625
- and the drift that or, I guess, just,
505
00:18:23.625 --> 00:18:24.525
- like, the crossover
506
00:18:24.825 --> 00:18:27.225
- that happens between the two of those. Alright.
507
00:18:27.225 --> 00:18:28.424
- So when you were in there, you were
508
00:18:28.424 --> 00:18:30.744
- talking about, like, number of configuration items, like,
509
00:18:30.744 --> 00:18:33.144
- number of resources that you could monitor. That's
510
00:18:33.144 --> 00:18:33.644
- another
511
00:18:33.945 --> 00:18:36.500
- pillar of this thing. So we kinda talked
512
00:18:36.500 --> 00:18:38.980
- about discoverability. It helps you find tenants you
513
00:18:38.980 --> 00:18:40.980
- didn't know about. It gives you a little
514
00:18:40.980 --> 00:18:42.819
- bit of a way to come in and
515
00:18:42.819 --> 00:18:45.220
- administer them. The other one is it gives
516
00:18:45.220 --> 00:18:46.839
- you configuration management,
517
00:18:47.140 --> 00:18:48.119
- so you can
518
00:18:48.704 --> 00:18:51.664
- monitor your existing tenant. Or if you're multi
519
00:18:51.664 --> 00:18:54.804
- tenant, you can also monitor for configuration
520
00:18:55.184 --> 00:18:55.684
- drift
521
00:18:56.144 --> 00:18:57.204
- against baselines.
522
00:18:57.505 --> 00:18:59.105
- So you can create a you can take,
523
00:18:59.105 --> 00:19:01.025
- like, a snapshot of your existing tenant. It
524
00:19:01.025 --> 00:19:03.424
- all gets expressed as JSON out the other
525
00:19:03.424 --> 00:19:05.119
- side, So you can take that as, like,
526
00:19:05.119 --> 00:19:07.220
- a a JSON baseline, JSON snapshot,
527
00:19:07.679 --> 00:19:10.079
- and you can actually monitor not only your
528
00:19:10.079 --> 00:19:12.399
- own tenant, but even, like, other tenants if
529
00:19:12.399 --> 00:19:14.980
- you did happen to be administering multiple tenants
530
00:19:15.359 --> 00:19:17.359
- for Drift along the way. That that was
531
00:19:17.359 --> 00:19:19.904
- another interesting one. I was really hoping, like,
532
00:19:19.904 --> 00:19:21.345
- when I was going through the documentation, I
533
00:19:21.345 --> 00:19:23.024
- was like, can you just give me, like,
534
00:19:23.024 --> 00:19:24.404
- the entire JSON schema?
535
00:19:25.105 --> 00:19:27.424
- And I was, like, clicking down down to
536
00:19:27.424 --> 00:19:28.404
- try and get there,
537
00:19:29.024 --> 00:19:31.184
- and it just wasn't happening. Like, they were
538
00:19:31.184 --> 00:19:31.924
- just, like,
539
00:19:32.224 --> 00:19:32.724
- so,
540
00:19:33.839 --> 00:19:35.200
- they just make it so hard. Right? Like,
541
00:19:35.200 --> 00:19:36.319
- just show it to me all in one
542
00:19:36.319 --> 00:19:36.819
- place
543
00:19:37.119 --> 00:19:39.599
- rather than go read about this configuration item,
544
00:19:39.599 --> 00:19:41.679
- things like that. But I don't know. Have
545
00:19:41.679 --> 00:19:42.960
- you had a chance to play with that
546
00:19:42.960 --> 00:19:45.299
- one at all? So I have, and
547
00:19:45.679 --> 00:19:46.419
- this one
548
00:19:46.799 --> 00:19:49.865
- partially worked in my tenant. So this was
549
00:19:49.865 --> 00:19:51.464
- another one I went in and set up,
550
00:19:51.464 --> 00:19:53.304
- and it's like you said, you can go
551
00:19:53.304 --> 00:19:54.764
- in and start creating snapshots
552
00:19:55.304 --> 00:19:58.264
- of different things, and it'll give you different
553
00:19:58.264 --> 00:20:01.404
- tenants. So I went into snapshots and well,
554
00:20:01.784 --> 00:20:04.259
- tenant governance is GA'd. At least in my
555
00:20:04.259 --> 00:20:05.240
- tenant, snapshots
556
00:20:05.539 --> 00:20:07.700
- is still labeled with the preview flag in
557
00:20:07.700 --> 00:20:10.840
- parentheses next to it. So this particular
558
00:20:11.220 --> 00:20:11.720
- feature
559
00:20:12.740 --> 00:20:13.640
- of tenant governance
560
00:20:14.100 --> 00:20:16.035
- looks like it's still in preview. But once
561
00:20:16.035 --> 00:20:17.875
- you get in there, you can click to
562
00:20:17.875 --> 00:20:19.955
- create a new snapshot, and I can create
563
00:20:19.955 --> 00:20:20.775
- a new snapshot
564
00:20:21.154 --> 00:20:23.875
- of five different things. And maybe this is
565
00:20:23.875 --> 00:20:26.035
- why it doesn't have the full JSON all
566
00:20:26.035 --> 00:20:27.174
- in one is
567
00:20:27.820 --> 00:20:30.460
- I don't can I do one for all
568
00:20:30.460 --> 00:20:32.619
- of them? I could, in theory, do one
569
00:20:32.619 --> 00:20:34.140
- for all of them, but it gives me
570
00:20:34.140 --> 00:20:34.640
- checkboxes.
571
00:20:35.180 --> 00:20:37.359
- So for instance, I have Microsoft Entra,
572
00:20:37.740 --> 00:20:41.420
- I have Exchange Online, Microsoft Intune, Security and
573
00:20:41.420 --> 00:20:44.195
- Compliance, and Microsoft Teams that I can grab
574
00:20:44.195 --> 00:20:47.394
- these snapshots of. And under each one, under
575
00:20:47.394 --> 00:20:50.134
- Entra, I have 36 resources
576
00:20:50.515 --> 00:20:53.315
- where I can grab a snapshot of, like,
577
00:20:53.315 --> 00:20:55.095
- administrative units, applications,
578
00:20:56.099 --> 00:20:57.640
- authentication method policies,
579
00:20:58.339 --> 00:20:59.319
- policy authenticator,
580
00:20:59.619 --> 00:21:02.119
- policy for email, policy for five zero two,
581
00:21:02.339 --> 00:21:06.380
- group, role definitions, role settings, security defaults, all
582
00:21:06.380 --> 00:21:08.500
- of those. Exchange Online, Intune, they're all something
583
00:21:08.500 --> 00:21:10.515
- similar where it's multiple
584
00:21:10.894 --> 00:21:11.394
- resources
585
00:21:11.934 --> 00:21:13.315
- that you can pick and choose
586
00:21:13.855 --> 00:21:14.355
- of
587
00:21:14.894 --> 00:21:17.154
- what do I wanna capture in the snapshot
588
00:21:17.454 --> 00:21:18.994
- for Exchange. Do I care about
589
00:21:19.535 --> 00:21:22.414
- funny, ATP. It's not advanced threat protection anymore,
590
00:21:22.414 --> 00:21:24.835
- but it still says ATP policy for
591
00:21:25.269 --> 00:21:28.890
- three sixty five, data classification stuff, mailbox settings,
592
00:21:28.950 --> 00:21:31.990
- all of those. Once I select those, it
593
00:21:31.990 --> 00:21:34.089
- shows me the list of everything I selected.
594
00:21:34.549 --> 00:21:36.809
- I can go then name this snapshot,
595
00:21:37.294 --> 00:21:38.034
- and then
596
00:21:38.414 --> 00:21:39.075
- this one,
597
00:21:39.534 --> 00:21:41.694
- it doesn't have permission to all of that
598
00:21:41.694 --> 00:21:44.575
- stuff by default. So after I've picked what
599
00:21:44.575 --> 00:21:46.034
- I want to monitor
600
00:21:46.575 --> 00:21:47.075
- and
601
00:21:47.534 --> 00:21:48.994
- what I want to
602
00:21:49.615 --> 00:21:51.615
- not what I want. Well, it's monitor, it's
603
00:21:51.615 --> 00:21:53.909
- snapshot, all of those. It gives me a
604
00:21:53.909 --> 00:21:56.889
- whole list of for Microsoft Exchange except domain,
605
00:21:56.950 --> 00:21:59.029
- I need Exchange manages app. You need a
606
00:21:59.029 --> 00:22:00.629
- bunch of permissions in the graph. I need
607
00:22:00.629 --> 00:22:02.470
- a bunch of permissions. All the graph permissions.
608
00:22:02.470 --> 00:22:05.690
- You're monitoring so you're monitoring configuration for resources.
609
00:22:06.865 --> 00:22:08.724
- It's another weird one. So so there's
610
00:22:09.265 --> 00:22:11.265
- six services that sit at the top that
611
00:22:11.265 --> 00:22:13.924
- you can monitor for resources and drift within.
612
00:22:14.224 --> 00:22:15.684
- So you've got Entra itself.
613
00:22:15.984 --> 00:22:18.005
- You've got Intune, Exchange Online,
614
00:22:18.384 --> 00:22:18.884
- Teams,
615
00:22:19.619 --> 00:22:22.980
- Purview, and Defender, and that's it. Yeah. Which
616
00:22:22.980 --> 00:22:25.960
- Purview and Defender are actually rolled into
617
00:22:26.500 --> 00:22:29.220
- one category in the UI itself. In the
618
00:22:29.220 --> 00:22:30.599
- UI, but not in the API.
619
00:22:30.980 --> 00:22:33.014
- So so back to that whole, like, hey.
620
00:22:33.014 --> 00:22:34.375
- I just wanna see, like, JSON in one
621
00:22:34.375 --> 00:22:36.294
- thing. It's all API driven through the graph.
622
00:22:36.294 --> 00:22:37.174
- So I don't know if you had a
623
00:22:37.174 --> 00:22:39.255
- chance to dig into some of this at
624
00:22:39.255 --> 00:22:41.255
- all. But if you go on to the
625
00:22:41.255 --> 00:22:42.474
- graph side of things,
626
00:22:42.934 --> 00:22:45.595
- it's basically just a bunch of graph queries
627
00:22:46.090 --> 00:22:48.250
- or graph APIs that you can go ahead
628
00:22:48.250 --> 00:22:48.750
- and
629
00:22:49.049 --> 00:22:51.049
- interrogate to figure some of this stuff out.
630
00:22:51.049 --> 00:22:54.570
- So the like, things like configuration drift, there's
631
00:22:54.570 --> 00:22:56.330
- just an API endpoint. You do a git
632
00:22:56.330 --> 00:22:58.555
- against it, like an HGB git On the
633
00:22:58.555 --> 00:23:01.515
- graph, it supports o data style queries, so,
634
00:23:01.515 --> 00:23:03.755
- like, select statements, things like that. So you
635
00:23:03.755 --> 00:23:06.394
- can, like, select into a given resource type,
636
00:23:06.394 --> 00:23:09.355
- see kinda, like, previous value, current values, things
637
00:23:09.755 --> 00:23:12.960
- desired value, things like that along the way.
638
00:23:12.960 --> 00:23:14.960
- And then some of the stuff like creating
639
00:23:14.960 --> 00:23:16.799
- snapshots, all that, you you can also do
640
00:23:16.799 --> 00:23:19.039
- that, but you can just instantiate those or
641
00:23:19.039 --> 00:23:20.799
- kick off those jobs via the graph if
642
00:23:20.799 --> 00:23:22.880
- you wanted to too. So it's kinda easy
643
00:23:22.880 --> 00:23:24.884
- to bootstrap around. It is a little bit
644
00:23:24.884 --> 00:23:27.365
- weird the way the UI differs from the
645
00:23:27.684 --> 00:23:29.765
- well, I mean, it's Microsoft. It wouldn't be
646
00:23:29.765 --> 00:23:31.765
- weird if they didn't do it. But that
647
00:23:31.924 --> 00:23:33.684
- like you said, like, the UI does differ
648
00:23:33.684 --> 00:23:36.005
- than the underlying API surface or what the
649
00:23:36.005 --> 00:23:37.845
- API presents back to you. Like, it's not
650
00:23:37.845 --> 00:23:38.984
- a one to one representation.
651
00:23:39.380 --> 00:23:40.980
- So if you wanted to, like, really get
652
00:23:40.980 --> 00:23:42.820
- into it, like, it's just all sitting there
653
00:23:42.820 --> 00:23:44.420
- behind a graph query, and at least that
654
00:23:44.420 --> 00:23:45.960
- stuff's documented ish.
655
00:23:47.380 --> 00:23:50.360
- If you're managing file storage today, you've probably
656
00:23:50.500 --> 00:23:53.140
- felt the pressure. Refresh cycles are harder to
657
00:23:53.140 --> 00:23:56.554
- plan, costs and complexity are increasing, especially as
658
00:23:56.554 --> 00:23:58.575
- file workloads scale across regions.
659
00:23:58.954 --> 00:24:02.315
- That's why Microsoft customers trust Nasuni. As an
660
00:24:02.315 --> 00:24:03.855
- Azure certified software,
661
00:24:04.234 --> 00:24:07.194
- Nasuni provides a global file system designed for
662
00:24:07.194 --> 00:24:08.575
- enterprise scale environments,
663
00:24:09.019 --> 00:24:12.460
- keeping file data secure, governed, and accessible across
664
00:24:12.460 --> 00:24:15.519
- Azure environments without added infrastructure complexity.
665
00:24:15.899 --> 00:24:16.960
- It's the foundation
666
00:24:17.259 --> 00:24:20.220
- to keep your unstructured data stable even as
667
00:24:20.220 --> 00:24:20.960
- your infrastructure
668
00:24:21.339 --> 00:24:23.664
- evolves. To see how much you could save
669
00:24:23.664 --> 00:24:26.085
- while keeping your initiatives on track, visit
670
00:24:26.384 --> 00:24:29.984
- nasuni.com/tco.
671
00:24:29.984 --> 00:24:34.644
- That's nasuni.com/tco.
672
00:24:35.825 --> 00:24:39.099
- There's lots of service not lots. There's services
673
00:24:39.099 --> 00:24:41.019
- out here that have kinda done this before.
674
00:24:41.019 --> 00:24:43.759
- Like, we've had the m three sixty five
675
00:24:43.980 --> 00:24:46.460
- desired state config that Microsoft three sixty five
676
00:24:46.460 --> 00:24:46.960
- DSC.
677
00:24:47.580 --> 00:24:49.994
- The Entra, Merrill did some stuff. We've talked
678
00:24:49.994 --> 00:24:51.755
- to Meryl before on the podcast. He did
679
00:24:51.755 --> 00:24:53.535
- some stuff with, like, the Entra exporter
680
00:24:54.075 --> 00:24:56.795
- where it's essentially kinda doing the same thing
681
00:24:56.795 --> 00:24:58.555
- that this is in the UI. It's connecting
682
00:24:58.555 --> 00:25:01.595
- to the graph, come having some JSON schema
683
00:25:01.595 --> 00:25:03.134
- that it's then outputting,
684
00:25:03.529 --> 00:25:05.609
- and then you can go ahead and import
685
00:25:05.609 --> 00:25:07.069
- it. You can go look through the JSON.
686
00:25:07.210 --> 00:25:09.049
- So I would say this part of it
687
00:25:09.049 --> 00:25:12.669
- from the Snapshot's perspective is doing something very
688
00:25:12.730 --> 00:25:14.970
- similar to what those tools are doing. It's
689
00:25:14.970 --> 00:25:16.750
- just putting it right in the UI
690
00:25:17.115 --> 00:25:19.434
- and, to your point, letting you do things
691
00:25:19.434 --> 00:25:21.055
- like monitor configuration
692
00:25:21.434 --> 00:25:22.575
- drift right
693
00:25:22.954 --> 00:25:25.115
- in the UI itself. You can go into
694
00:25:25.115 --> 00:25:27.595
- one of these snapshots once it's run, go
695
00:25:27.595 --> 00:25:30.359
- download the JSON for yourself, look at that,
696
00:25:30.579 --> 00:25:32.659
- or and I think this is where some
697
00:25:32.659 --> 00:25:34.039
- of this gets interesting
698
00:25:34.579 --> 00:25:35.079
- too,
699
00:25:35.460 --> 00:25:35.960
- is
700
00:25:36.259 --> 00:25:38.419
- as you have these snapshots and you find
701
00:25:38.419 --> 00:25:41.720
- related tenants, you can also start selecting tenants
702
00:25:41.779 --> 00:25:44.535
- that you maybe want that you maybe tenants
703
00:25:44.535 --> 00:25:46.454
- that you wanna govern, and then you can
704
00:25:46.454 --> 00:25:47.595
- use these snapshots
705
00:25:48.295 --> 00:25:50.394
- to help keep your different tenants
706
00:25:50.855 --> 00:25:53.575
- configured the same way where you're taking some
707
00:25:53.575 --> 00:25:55.734
- of this configuration, you're taking some of these
708
00:25:55.734 --> 00:25:56.234
- snapshots.
709
00:25:56.869 --> 00:25:59.109
- You can go in and set it's not
710
00:25:59.109 --> 00:26:00.710
- really in templates, but you can go in
711
00:26:00.710 --> 00:26:03.509
- and set these settings for tenants that you
712
00:26:03.509 --> 00:26:04.490
- are now governing
713
00:26:04.950 --> 00:26:08.150
- and have a central management spot where you
714
00:26:08.150 --> 00:26:08.970
- can manage
715
00:26:09.585 --> 00:26:12.325
- some of these configuration settings. So
716
00:26:12.865 --> 00:26:14.804
- I think in multi tenant organizations
717
00:26:15.105 --> 00:26:17.744
- or maybe, again, organizations where you have like
718
00:26:17.744 --> 00:26:19.444
- a prod test and dev
719
00:26:19.744 --> 00:26:21.984
- and you wanna make sure these tenants are
720
00:26:21.984 --> 00:26:23.505
- staying aligned from a settings perspective, from a
721
00:26:23.505 --> 00:26:24.644
- security perspective.
722
00:26:27.000 --> 00:26:29.480
- You wanna make sure you reset test to
723
00:26:29.480 --> 00:26:30.539
- match production before
724
00:26:30.839 --> 00:26:31.899
- you test a new setting.
725
00:26:32.599 --> 00:26:34.700
- That's where this some of this tenant governance
726
00:26:34.759 --> 00:26:36.599
- stuff can also get interesting. So it starts
727
00:26:36.599 --> 00:26:37.639
- to pull you back a little bit to
728
00:26:37.639 --> 00:26:40.125
- the licensing thing though. So that then then
729
00:26:40.205 --> 00:26:41.644
- because remember, you're gonna be limited by the
730
00:26:41.644 --> 00:26:43.984
- number of monitors and the number of
731
00:26:44.445 --> 00:26:44.945
- configuration
732
00:26:45.644 --> 00:26:46.144
- resources
733
00:26:46.605 --> 00:26:49.164
- per tenant per day that you can pull
734
00:26:49.164 --> 00:26:50.785
- on. And then there's actually
735
00:26:51.325 --> 00:26:54.880
- limits, like, scale limits within the runs themselves
736
00:26:55.259 --> 00:26:56.460
- here. So,
737
00:26:56.940 --> 00:26:58.960
- if you do turn this on, they run
738
00:26:59.019 --> 00:27:00.320
- every six hours
739
00:27:00.779 --> 00:27:01.279
- ish.
740
00:27:01.660 --> 00:27:03.179
- So, like, if you go and say, hey.
741
00:27:03.179 --> 00:27:04.380
- I'm gonna run and get one of these
742
00:27:04.380 --> 00:27:06.700
- baselines. It's not gonna be an immediate kinda
743
00:27:06.700 --> 00:27:08.045
- thing just like when you were talking about,
744
00:27:08.045 --> 00:27:10.204
- like, maybe one to two days for some
745
00:27:10.204 --> 00:27:12.684
- of the discovery components a little bit earlier.
746
00:27:12.684 --> 00:27:14.204
- So you gotta wait a little bit of
747
00:27:14.204 --> 00:27:15.805
- time for things to show up. And then
748
00:27:15.805 --> 00:27:17.644
- what shows up might not be the complete
749
00:27:17.644 --> 00:27:20.049
- picture, especially on the first run, because it
750
00:27:20.049 --> 00:27:21.730
- could take multiple runs to get through it
751
00:27:21.730 --> 00:27:24.690
- with the scale limits that are there around,
752
00:27:24.690 --> 00:27:27.490
- like, resource instances per baseline that you can
753
00:27:27.490 --> 00:27:29.990
- pull back, and then how many resource instances
754
00:27:30.130 --> 00:27:32.070
- per day across all those monitors
755
00:27:32.529 --> 00:27:34.210
- that you can get out and have come
756
00:27:34.210 --> 00:27:35.375
- back, plus
757
00:27:35.755 --> 00:27:37.835
- the, I think, the fiddliness of some of
758
00:27:37.835 --> 00:27:38.654
- the permissions
759
00:27:39.195 --> 00:27:40.714
- that you talked about and some of the
760
00:27:40.714 --> 00:27:42.954
- permissions set up. So needing to make sure
761
00:27:42.954 --> 00:27:46.394
- that, like, hey. You've got, like, policy.read.all
762
00:27:46.394 --> 00:27:47.934
- for conditional access.
763
00:27:48.609 --> 00:27:50.609
- You've got all your role assignments for, let's
764
00:27:50.609 --> 00:27:54.149
- say, Teams with Teams readers and Teams resources.
765
00:27:54.849 --> 00:27:57.250
- Exchange certainly has its own set of things
766
00:27:57.250 --> 00:27:58.690
- out there. So I can see a lot
767
00:27:58.690 --> 00:28:00.529
- of, like, fits and starts too to, like,
768
00:28:00.529 --> 00:28:01.809
- oh, hey. I turned this on. I ran
769
00:28:01.809 --> 00:28:03.095
- it. I don't think it showed me everything
770
00:28:03.095 --> 00:28:04.615
- it was supposed to. Oh, wait. I forgot
771
00:28:04.615 --> 00:28:07.335
- that permission. Let me let me go back
772
00:28:07.335 --> 00:28:09.414
- and wire that up again. It does give
773
00:28:09.414 --> 00:28:10.934
- you, like, a health check when you do
774
00:28:10.934 --> 00:28:12.535
- it. So when you click to permissions, it'll
775
00:28:12.535 --> 00:28:14.215
- say whether all the permissions are there or
776
00:28:14.215 --> 00:28:16.849
- not. And that's where mine was odd. I
777
00:28:16.849 --> 00:28:19.009
- have all the permissions there. It did take
778
00:28:19.009 --> 00:28:20.690
- me like there's no select all. It took
779
00:28:20.690 --> 00:28:22.210
- me like thirty or forty five minutes to
780
00:28:22.210 --> 00:28:23.970
- go select all the permissions one at a
781
00:28:23.970 --> 00:28:26.130
- time and flip back and forth between two
782
00:28:26.130 --> 00:28:28.164
- screens. But even then, I still have some
783
00:28:28.164 --> 00:28:30.484
- that are partially successful, some failed that I
784
00:28:30.484 --> 00:28:32.265
- haven't had time to go back and troubleshoot.
785
00:28:32.325 --> 00:28:34.244
- So to your point, this is not just
786
00:28:34.244 --> 00:28:36.164
- to go turn it on and it works.
787
00:28:36.164 --> 00:28:38.164
- And even if you have all the permissions,
788
00:28:38.164 --> 00:28:40.484
- it's gonna run them all and get everything
789
00:28:40.484 --> 00:28:43.289
- back the first time. It did seem to
790
00:28:43.289 --> 00:28:45.529
- be A little moody. Yeah. A fickle. A
791
00:28:45.529 --> 00:28:47.710
- little fickle. Fickle. Yeah. Yeah. There
792
00:28:48.250 --> 00:28:50.170
- there there there we go. Alright. So let's
793
00:28:50.170 --> 00:28:52.170
- see. So we talked about a couple of
794
00:28:52.170 --> 00:28:55.130
- pillars with this thing. So we talked about
795
00:28:55.130 --> 00:28:56.269
- the governance thing.
796
00:28:56.684 --> 00:29:00.204
- We talked about monitoring for configuration drift. We
797
00:29:00.204 --> 00:29:01.505
- haven't talked about
798
00:29:02.044 --> 00:29:04.605
- gating the creation of new tenants. I think
799
00:29:04.605 --> 00:29:06.924
- that's kinda the the last one that sits
800
00:29:06.924 --> 00:29:08.304
- out there. So
801
00:29:08.605 --> 00:29:09.904
- secure tenant
802
00:29:10.230 --> 00:29:10.730
- creation
803
00:29:11.029 --> 00:29:12.490
- or creating a
804
00:29:12.789 --> 00:29:13.849
- governed workforce
805
00:29:14.150 --> 00:29:16.869
- tenant and what comes along with that one.
806
00:29:16.869 --> 00:29:18.789
- Yeah. And this one, I will say, I
807
00:29:18.789 --> 00:29:20.710
- have not looked into this one as much.
808
00:29:20.710 --> 00:29:22.404
- I didn't get that far when I was
809
00:29:22.404 --> 00:29:25.125
- digging through it. So what is that, Scott?
810
00:29:25.125 --> 00:29:26.484
- Have you read about that one? Have you
811
00:29:26.484 --> 00:29:27.845
- read up on that? Did you do better
812
00:29:27.845 --> 00:29:30.005
- homework than I did on that particular aspect
813
00:29:30.005 --> 00:29:32.505
- of it? It's another, like, weird, like, little
814
00:29:32.644 --> 00:29:33.144
- licensing
815
00:29:33.525 --> 00:29:34.025
- thing
816
00:29:34.404 --> 00:29:35.384
- that that happened.
817
00:29:35.765 --> 00:29:37.384
- You've got your licensing for
818
00:29:37.909 --> 00:29:38.970
- for tenant governance,
819
00:29:39.349 --> 00:29:42.390
- and then there's kinda, like, more restrictive licensing
820
00:29:42.390 --> 00:29:44.549
- that sits and hops on top of this
821
00:29:44.549 --> 00:29:45.849
- if you want to
822
00:29:46.230 --> 00:29:48.890
- create a new tenant with this governed workforce
823
00:29:49.029 --> 00:29:51.625
- option. And when you do that, the base
824
00:29:51.625 --> 00:29:53.884
- workflow is you're gonna get a new tenant.
825
00:29:54.025 --> 00:29:55.724
- It's going to get an established
826
00:29:56.265 --> 00:29:57.325
- governance relationship,
827
00:29:57.944 --> 00:30:00.664
- and it's gonna use a policy template. It's
828
00:30:00.664 --> 00:30:02.984
- just gonna use the default policy template that's
829
00:30:02.984 --> 00:30:04.759
- there for you. It will provision
830
00:30:05.220 --> 00:30:07.720
- a Microsoft Intra ID
831
00:30:08.340 --> 00:30:10.279
- free billing asset in
832
00:30:10.900 --> 00:30:14.500
- your Azure subscription resource group of choice, and
833
00:30:14.500 --> 00:30:17.174
- then it adds that tenant back to your
834
00:30:17.174 --> 00:30:18.315
- related tenant
835
00:30:18.615 --> 00:30:19.115
- inventory.
836
00:30:19.575 --> 00:30:21.894
- So it kinda kinda spins it up, gets
837
00:30:21.894 --> 00:30:23.595
- it in there, wires up the relationship,
838
00:30:24.375 --> 00:30:26.234
- and it's all set
839
00:30:26.615 --> 00:30:28.394
- and ready to go. Prerequisites.
840
00:30:28.710 --> 00:30:30.390
- There's a whole bunch of them here. So
841
00:30:30.390 --> 00:30:33.029
- your home tenant so so the tenant that
842
00:30:33.029 --> 00:30:35.529
- you're, I guess, in initiating or instantiated
843
00:30:36.069 --> 00:30:38.710
- Yeah. Essentially, your parent tenant. It requires at
844
00:30:38.710 --> 00:30:42.515
- least one paid license based Microsoft product. Okay.
845
00:30:42.815 --> 00:30:44.335
- So that that makes sense. Right? I'd have
846
00:30:44.335 --> 00:30:46.275
- p one, p two. And probably EntraSweet
847
00:30:46.575 --> 00:30:47.075
- or
848
00:30:47.535 --> 00:30:49.695
- your governance one, so you're at least at
849
00:30:49.695 --> 00:30:50.974
- a p two with a step up or
850
00:30:50.974 --> 00:30:52.974
- an e seven for that one license. Free
851
00:30:52.974 --> 00:30:54.755
- and trial licenses don't qualify.
852
00:30:55.130 --> 00:30:56.250
- You wouldn't even be able to play around
853
00:30:56.250 --> 00:30:57.869
- with it there. Don't bother.
854
00:30:58.330 --> 00:31:00.029
- You also need a
855
00:31:00.570 --> 00:31:01.070
- paid
856
00:31:01.529 --> 00:31:02.029
- MCA
857
00:31:02.490 --> 00:31:03.470
- or EA
858
00:31:03.930 --> 00:31:06.029
- or pay as you go subscription
859
00:31:06.490 --> 00:31:08.670
- for Azure. So that's another
860
00:31:09.255 --> 00:31:11.734
- requirement that sits out there. You need the
861
00:31:11.734 --> 00:31:13.275
- tenant creator role,
862
00:31:13.654 --> 00:31:14.154
- and
863
00:31:14.615 --> 00:31:15.595
- that's required
864
00:31:16.134 --> 00:31:18.375
- no matter what. So if you've already set
865
00:31:18.375 --> 00:31:20.295
- out there and I there's, like, a setting
866
00:31:20.295 --> 00:31:23.174
- for restricting non admin users from creating tenant
867
00:31:23.174 --> 00:31:25.440
- settings, things like that. Yep. You gotta go
868
00:31:25.440 --> 00:31:28.179
- override all that stuff. You need ARM permissions,
869
00:31:28.559 --> 00:31:32.000
- so Azure resource manager permissions. So things like
870
00:31:32.000 --> 00:31:33.220
- subscription owner,
871
00:31:33.599 --> 00:31:34.419
- tenant contributor,
872
00:31:34.880 --> 00:31:37.279
- all that needs to be there. And the
873
00:31:37.279 --> 00:31:39.839
- default policy template so when I say default
874
00:31:39.839 --> 00:31:41.654
- policy template, it actually needs to have the
875
00:31:41.654 --> 00:31:42.154
- ID
876
00:31:42.454 --> 00:31:45.335
- default. Like, that's it. It's hard coded in
877
00:31:45.335 --> 00:31:47.914
- some place that it says, like, default is
878
00:31:47.974 --> 00:31:50.534
- default. Which is interesting because default is there
879
00:31:50.534 --> 00:31:51.974
- by default, but you do have the option
880
00:31:51.974 --> 00:31:53.734
- to create new ones, but I don't think
881
00:31:53.734 --> 00:31:55.414
- you can name new ones default. But don't
882
00:31:55.414 --> 00:31:57.980
- change default. So if no default tenant is
883
00:31:57.980 --> 00:31:59.819
- there, you'll, like, you'll get a new if
884
00:31:59.819 --> 00:32:02.880
- no default policy is there, you will get
885
00:32:03.019 --> 00:32:03.519
- a
886
00:32:03.980 --> 00:32:06.779
- if no default policy template is there, you
887
00:32:06.779 --> 00:32:08.380
- will get a new tenant created for you,
888
00:32:08.380 --> 00:32:09.679
- but the governance relationship
889
00:32:10.059 --> 00:32:11.039
- won't be established.
890
00:32:11.404 --> 00:32:14.384
- So it just kinda, like, silently fails and
891
00:32:14.524 --> 00:32:17.904
- moves on and says, okay. I'm good and
892
00:32:18.684 --> 00:32:19.664
- ready to go.
893
00:32:20.924 --> 00:32:22.524
- So you can get out there. You can
894
00:32:22.524 --> 00:32:23.345
- do these things.
895
00:32:23.710 --> 00:32:24.450
- You can certainly
896
00:32:24.910 --> 00:32:27.230
- go and create these tenants and spin them
897
00:32:27.230 --> 00:32:28.450
- up and have these relationships,
898
00:32:28.830 --> 00:32:30.910
- create them against policy, things like that. I
899
00:32:30.910 --> 00:32:32.590
- don't know how valuable it is versus just
900
00:32:32.590 --> 00:32:33.869
- saying, like, hey. I'm gonna go create a
901
00:32:33.869 --> 00:32:35.470
- new tenant and then just let it find
902
00:32:35.470 --> 00:32:37.150
- its own thing if you're already spun up
903
00:32:37.150 --> 00:32:38.565
- and ready to go for it if you
904
00:32:38.565 --> 00:32:40.644
- don't need everything that comes in the default
905
00:32:40.644 --> 00:32:43.365
- policy or anything like that. I was looking
906
00:32:43.365 --> 00:32:44.505
- at these policies,
907
00:32:45.204 --> 00:32:45.704
- and
908
00:32:46.164 --> 00:32:48.565
- right now, I mean, there's there I can
909
00:32:48.565 --> 00:32:50.565
- see some value. So one of the things
910
00:32:50.565 --> 00:32:52.024
- that can be part of these templates
911
00:32:52.404 --> 00:32:53.544
- is adding assignments.
912
00:32:53.899 --> 00:32:56.139
- So I think a big organization, you have
913
00:32:56.139 --> 00:32:57.519
- a development team of
914
00:32:57.819 --> 00:32:59.919
- a 100 people, 200 people.
915
00:33:00.299 --> 00:33:02.299
- You can add default roles to this where
916
00:33:02.299 --> 00:33:04.139
- you could go select a security group in
917
00:33:04.139 --> 00:33:06.000
- your home tenant, all your developers,
918
00:33:06.454 --> 00:33:08.615
- and say in this particular tenant, all of
919
00:33:08.615 --> 00:33:09.434
- my developers
920
00:33:10.134 --> 00:33:10.634
- have
921
00:33:10.934 --> 00:33:11.755
- this particular
922
00:33:12.535 --> 00:33:14.394
- role, whether you're giving
923
00:33:14.775 --> 00:33:17.174
- them enter ID admin or whether you're giving
924
00:33:17.174 --> 00:33:17.674
- them
925
00:33:18.295 --> 00:33:20.039
- some other Azure role,
926
00:33:21.140 --> 00:33:23.220
- then when this tenant gets spun up, all
927
00:33:23.220 --> 00:33:24.359
- of these users
928
00:33:24.820 --> 00:33:25.320
- automatically
929
00:33:25.940 --> 00:33:28.500
- have that level of access and that governed
930
00:33:28.500 --> 00:33:31.079
- tenant. I'm assuming it automatically does
931
00:33:31.394 --> 00:33:33.654
- not necessarily a b two b sync, but,
932
00:33:33.715 --> 00:33:35.335
- like, invites them all as guests,
933
00:33:35.875 --> 00:33:37.494
- probably makes their accounts
934
00:33:37.955 --> 00:33:40.295
- members instead of guests in this new tenant,
935
00:33:40.515 --> 00:33:41.494
- and provides
936
00:33:41.795 --> 00:33:43.955
- that level of assignment so you don't have
937
00:33:43.955 --> 00:33:45.759
- to then go in after it's created and
938
00:33:45.759 --> 00:33:47.679
- go grant a bunch of users access, invite
939
00:33:47.679 --> 00:33:49.200
- their guest accounts, all of that. It does
940
00:33:49.200 --> 00:33:50.720
- some of that wiring up in the back
941
00:33:50.720 --> 00:33:53.140
- end. The only other thing that's in there
942
00:33:53.200 --> 00:33:53.700
- is
943
00:33:54.000 --> 00:33:55.539
- adding multi tenant applications.
944
00:33:55.839 --> 00:33:56.339
- So
945
00:33:56.720 --> 00:34:00.259
- going in and provisioning multi tenant applications,
946
00:34:00.815 --> 00:34:02.994
- but it's only multi tenant applications
947
00:34:03.615 --> 00:34:05.154
- from your organization.
948
00:34:05.535 --> 00:34:07.234
- So if it's multi tenant applications
949
00:34:07.535 --> 00:34:10.014
- that you've purchased that you want in both
950
00:34:10.014 --> 00:34:13.934
- tenants, you can automatically deploy those. These appear
951
00:34:13.934 --> 00:34:17.539
- to be ones that, again, only you have.
952
00:34:17.599 --> 00:34:20.079
- I was trying to yeah. Like mine, when
953
00:34:20.079 --> 00:34:21.840
- I go do it, I just have four
954
00:34:21.840 --> 00:34:24.099
- applications that I could include in a policy.
955
00:34:24.320 --> 00:34:26.880
- It's not the 80 or 90 that I
956
00:34:26.880 --> 00:34:29.380
- have in my current tenant. It's like Copilot
957
00:34:29.599 --> 00:34:30.099
- Studio,
958
00:34:30.714 --> 00:34:31.855
- Power Virtual Agents,
959
00:34:32.394 --> 00:34:35.594
- and then it looks like a PowerShell one.
960
00:34:35.594 --> 00:34:37.355
- It's all the built in. Well, there's a
961
00:34:37.355 --> 00:34:40.554
- PowerShell one that it maybe I created as
962
00:34:40.554 --> 00:34:42.714
- a multi tenant application with some of the
963
00:34:42.714 --> 00:34:44.255
- new PowerShell login requirements.
964
00:34:44.820 --> 00:34:47.380
- So I think if I custom developed my
965
00:34:47.380 --> 00:34:49.860
- own as a multi tenant, there's a limited
966
00:34:49.860 --> 00:34:51.940
- set you can push out here. And right
967
00:34:51.940 --> 00:34:53.480
- now, those are the only
968
00:34:53.860 --> 00:34:55.300
- things that you can include in one of
969
00:34:55.300 --> 00:34:57.780
- those templates is those two things. Gives you
970
00:34:57.780 --> 00:34:59.625
- so much. I think the I see the
971
00:34:59.625 --> 00:35:01.864
- bigger benefit here coming from kinda what we
972
00:35:01.864 --> 00:35:03.704
- talked about with Snapshot is doing a new
973
00:35:03.704 --> 00:35:04.204
- configuration
974
00:35:04.505 --> 00:35:06.744
- sync, where you can do a cross tenant
975
00:35:06.744 --> 00:35:07.244
- sync,
976
00:35:07.784 --> 00:35:10.765
- and there, you can actually sync across different
977
00:35:11.280 --> 00:35:13.199
- Configuration management is probably your most, like, bang
978
00:35:13.199 --> 00:35:14.880
- for your buck, and you get that with
979
00:35:14.880 --> 00:35:16.880
- the e threes and e fives, like your
980
00:35:16.880 --> 00:35:18.640
- p ones and p twos. You don't need
981
00:35:18.640 --> 00:35:20.400
- that additive license. Some of this other stuff,
982
00:35:20.400 --> 00:35:23.619
- like, related tenants, all that, that definitely requires
983
00:35:23.760 --> 00:35:24.980
- that additive license.
984
00:35:25.394 --> 00:35:27.474
- So if you're, like, listening, you're like, hey.
985
00:35:27.474 --> 00:35:29.155
- That's the thing I really wanted. Well, guess
986
00:35:29.155 --> 00:35:31.394
- what? Like, that's the most expensive part of
987
00:35:31.394 --> 00:35:33.074
- the car that you've gotta go out and
988
00:35:33.074 --> 00:35:34.534
- get. But if all you're looking
989
00:35:34.835 --> 00:35:37.074
- for is, like, hey. I just need, like,
990
00:35:37.074 --> 00:35:39.155
- four wheels and something that has a light
991
00:35:39.155 --> 00:35:41.670
- engine that gets me around. That's your e
992
00:35:41.670 --> 00:35:43.429
- threes, your e fives, your p one, and
993
00:35:43.429 --> 00:35:45.349
- p two licenses, and they get you the
994
00:35:45.349 --> 00:35:47.429
- vast majority of this stuff. In some of
995
00:35:47.429 --> 00:35:49.510
- these, kinda like the snapshots is still in
996
00:35:49.510 --> 00:35:51.929
- preview, the cross tenant synchronization
997
00:35:52.630 --> 00:35:53.449
- for configurations
998
00:35:54.195 --> 00:35:56.994
- is also still public preview, at least in
999
00:35:56.994 --> 00:35:58.355
- my tenant. It still has a bar at
1000
00:35:58.355 --> 00:36:00.914
- the top, cross tenants oh, security group. Not
1001
00:36:00.914 --> 00:36:02.375
- the whole cross tenant synchronization.
1002
00:36:02.835 --> 00:36:04.934
- Cross tenant security group synchronization
1003
00:36:05.555 --> 00:36:07.909
- is in public preview, which is a part
1004
00:36:07.969 --> 00:36:09.589
- of that cross tenant synchronization.
1005
00:36:09.889 --> 00:36:12.609
- As usual, license licensing remains clear as mud.
1006
00:36:12.609 --> 00:36:14.210
- But I think this does if you're in
1007
00:36:14.210 --> 00:36:16.130
- one of those scenarios where you have multiple
1008
00:36:16.130 --> 00:36:18.549
- tenants, you wanna manage some of these applications,
1009
00:36:19.170 --> 00:36:21.989
- especially if you already have an e seven
1010
00:36:22.130 --> 00:36:22.630
- license,
1011
00:36:23.244 --> 00:36:24.525
- or even if you do have an e
1012
00:36:24.525 --> 00:36:26.385
- fives and you want your
1013
00:36:26.764 --> 00:36:28.045
- admins to go in and run some of
1014
00:36:28.045 --> 00:36:31.025
- these snapshots, start watching for some of the
1015
00:36:31.244 --> 00:36:34.284
- configuration drift. There's some valuable features in here,
1016
00:36:34.284 --> 00:36:37.244
- not just from cross tenant governance, but also
1017
00:36:37.244 --> 00:36:40.119
- from just governing your own tenant and your
1018
00:36:40.119 --> 00:36:40.860
- own configurations.
1019
00:36:41.320 --> 00:36:43.719
- Anything else in tenant governance? Do we govern
1020
00:36:43.719 --> 00:36:46.059
- the ungovernable? We will never govern the ungovernable.
1021
00:36:46.199 --> 00:36:47.480
- It will always be a bit of the
1022
00:36:47.480 --> 00:36:49.640
- wild west. There will always be something new
1023
00:36:49.640 --> 00:36:51.800
- to govern, which is why it's ungovernable. I
1024
00:36:51.800 --> 00:36:53.099
- don't know. It's Monday.
1025
00:36:53.795 --> 00:36:54.454
- A Tuesday.
1026
00:36:54.994 --> 00:36:56.994
- Feels like Monday. It's a Monday. It's a
1027
00:36:56.994 --> 00:36:58.994
- Tuesday. It's a meeting. It's a Monday and
1028
00:36:58.994 --> 00:36:59.655
- a Tuesday.
1029
00:37:00.035 --> 00:37:01.795
- Does that mean Friday will feel like Thursday
1030
00:37:01.795 --> 00:37:02.835
- and all of a sudden it'll be the
1031
00:37:02.835 --> 00:37:05.894
- weekend? Something like that. Hopefully. Short week. Perfect.
1032
00:37:05.969 --> 00:37:07.730
- Should be easy. Should be easy. Except that
1033
00:37:07.730 --> 00:37:09.250
- all your meetings from five days are gonna
1034
00:37:09.250 --> 00:37:11.010
- get crammed into four. They are. And and
1035
00:37:11.010 --> 00:37:12.849
- speaking of meetings, it's time to get to
1036
00:37:12.849 --> 00:37:14.530
- the next one. It is that time. Alright,
1037
00:37:14.530 --> 00:37:16.449
- Scott. Well, thank you. Thank you for the
1038
00:37:16.449 --> 00:37:19.329
- tenant governance conversation today. We'd love to hear
1039
00:37:19.329 --> 00:37:21.010
- from others about how you might use tenant
1040
00:37:21.010 --> 00:37:23.545
- governance. Feel free to reach out, comment, LinkedIn,
1041
00:37:23.924 --> 00:37:24.424
- Reddit.
1042
00:37:24.724 --> 00:37:26.484
- Either of those two platforms tend to be
1043
00:37:26.484 --> 00:37:29.444
- where Scott and I are most active. And
1044
00:37:29.444 --> 00:37:31.045
- if you wanna see all my football rants,
1045
00:37:31.045 --> 00:37:33.525
- go look at x because I ranted about
1046
00:37:33.525 --> 00:37:35.710
- football this weekend. There you go. All my
1047
00:37:35.710 --> 00:37:38.510
- poor tech followers that care nothing about Michigan
1048
00:37:38.510 --> 00:37:39.010
- football
1049
00:37:39.309 --> 00:37:43.170
- or WMU football got an earful in x.
1050
00:37:44.430 --> 00:37:46.670
- Oh, so with that, Scott, go enjoy your
1051
00:37:46.670 --> 00:37:48.065
- next meeting, and we will talk to you
1052
00:37:48.065 --> 00:37:49.845
- next time. Sounds good. Thanks, Ben.
1053
00:37:51.825 --> 00:37:54.065
- If you enjoyed the podcast, go leave us
1054
00:37:54.065 --> 00:37:56.305
- a five star rating in iTunes. It helps
1055
00:37:56.305 --> 00:37:57.985
- to get the word out so more IT
1056
00:37:57.985 --> 00:38:00.144
- pros can learn about Office three sixty five
1057
00:38:00.144 --> 00:38:00.805
- and Azure.
1058
00:38:01.345 --> 00:38:03.025
- If you have any questions you want us
1059
00:38:03.025 --> 00:38:05.159
- to address on the show, or feedback about
1060
00:38:05.159 --> 00:38:07.559
- the show, feel free to reach out via
1061
00:38:07.559 --> 00:38:09.739
- our website, Twitter, or Facebook.
1062
00:38:10.039 --> 00:38:11.880
- Thanks again for listening, and have a great
1063
00:38:11.880 --> 00:38:12.380
- day.